cargo-audit: add binary scan size limits

[glaziermag]

Hi! My name is Gabriel, and I’m interested in the RustSec project and have been digging into binary scanning limits.

Related upstream issue: rustsec#740

Summary

• add cargo audit bin CLI flags for max input binary size and auditable payload size
• enforce a bounded read before parsing auditable data to avoid OOM on very large inputs
• add a regression test ensuring oversized inputs are rejected

Test plan

• cargo test -p cargo-audit
• cargo test --all-features -p cargo-audit
• cargo fmt --all -- --check
• cargo clippy --workspace --all-features --exclude=rustsec -- -D warnings
• cargo clippy --package=rustsec --features=dependency-tree,osv-export,binary-scanning -- -D warnings

[djc]

You filed this against your fork. If you intend to upstream these changes, you'll want to submit a PR against the upstream repo. Please squash all your commits before doing so.

[glaziermag]

Thanks! I’ve upstreamed this as a single squashed commit PR: rustsec#1516 (rustsec#1516). I’ll follow up there going forward.