Add cargo audit for services/api (#638)

[euniceamoni]

Closes #638

Add explicit cargo audit steps for services/api in dependency-scan.yml. The root workspace only covers contracts/*, so the API crate's dependencies (axum, sqlx, redis, reqwest) were never audited.

Changes:

• Split the single generic audit step into two targeted pairs, one for contracts/predict-iq and one for services/api, using working-directory
• Critical vulnerabilities in either crate fail the scan-rust job and block merges to main

[drips-wave]

@euniceamoni Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits