Using [`cargo-deny`](https://embarkstudios.github.io/cargo-deny/) to ensure that disallowed dependencies removed in #2423 do not accidentally make their way back in.
`cargo-deny` subsumes the `cargo-audit` functionality, so switch to the `cargo-deny` version.
Setting this up required explicitly stating the license which was not in some of our `Cargo.toml` files.
Use Codecov to show coverage reports, so we get highlighted versions of the files where it is easy to see missing coverage.
- Setup Rust coverage using [`cargo-llvm-cov`](https://github.com/taiki-e/cargo-llvm-cov).
- Add the `ci/agent.sh` build script to the agent artifact cache key, since it wasn't there before.
- Don't run Rust tests in `--release` mode (have been meaning to change this so doing it at the same time).
There is some subtlety about putting the coverage result into the cached agent artifact, so that when we reuse the agent artifact we can still upload the coverage information for it to Codecov. Without this it would look like the coverage had dropped.
