Add CI

[gabotechs]

Adds an ASF-compatible GitHub Actions baseline that checks formatting, Clippy, and the full workspace test suite on pull requests, main, and merge queues.

Rust setup and caching are centralized in a local action; dependency/build caches are restored for Clippy and tests and only saved from trusted main-branch runs. The PR also adds Dependabot coverage for Cargo and GitHub Actions (including local composite actions), an ASF action-allowlist check, and formats the existing code so the new format check passes.

[mbutrovich]

@gabotechs thanks for getting CI going. Limiting cache writes to trusted pushes on main with save-if, together with persist-credentials: false and SHA-pinned third-party actions, is a good security baseline for a new ASF repo. I checked the pins against the ASF allowlist and they all pass: dtolnay/rust-toolchain@4cda84d5 is listed by SHA, Swatinem/rust-cache@* is allowed, and actions/* is trusted.

The comments below are about keeping CI results stable over time: which toolchain and rustfmt style CI enforces, and whether pushes to main can cancel each other.

The branch is one commit behind main (#5 renamed .asf.yml to .asf.yaml). There's no conflict, but required_status_checks.contexts in .asf.yaml is still empty, so these jobs won't be required to merge. Do you plan to add Format, Clippy, and Test there once this lands? If so, could you open an issue for it so it doesn't get lost?

[gabotechs]

Do you plan to add Format, Clippy, and Test there once this lands? If so, could you open an issue for it so it doesn't get lost?

@mbutrovich I think we can actually do this now, unless you have a reason not to. Just added a commit for that.

[alamb]

At this point in the repos live I think getting the CI up and running is key -- we can iterate quickly as the repo is still forming

Thank you @gabotechs and @mbutrovich