fix(ci): fix MSRV if-let chains and cargo-deny config

- Convert remaining if-let chain in audio.rs for MSRV 1.85
- Add CDLA-Permissive-2.0 license for webpki-roots
- Allow workspace wildcards in bans config
- Ignore unmaintained crate advisories (transitive deps)

Author: santosr2

crates/rexos-hal/src/audio.rs

@@ -238,13 +238,14 @@ impl AudioManager {
         };
 
         for line in contents.lines() {
-            // Use if-let chain (Rust 2024) to reduce nesting
-            if let Some(idx) = line.find('[')
-                && let Some(end) = line.find(']')
-            {
-                let name = line[idx + 1..end].trim();
-                if !name.is_empty() {
-                    cards.push(name.to_string());
+            // Avoid if-let chains for MSRV 1.85 compatibility
+            #[allow(clippy::collapsible_if)]
+            if let Some(idx) = line.find('[') {
+                if let Some(end) = line.find(']') {
+                    let name = line[idx + 1..end].trim();
+                    if !name.is_empty() {
+                        cards.push(name.to_string());
+                    }
                 }
             }
         }

deny.toml

@@ -10,8 +10,9 @@ no-default-features = false
 [advisories]
 db-path = "~/.cargo/advisory-db"
 ignore = [
-    # Add ignored advisories here with comments explaining why
-    # "RUSTSEC-XXXX-XXXX", # reason
+    # Unmaintained crates that are transitive dependencies
+    "RUSTSEC-2024-0384",  # instant - unmaintained, used transitively
+    "RUSTSEC-2024-0436",  # paste - unmaintained, used transitively
 ]
 
 [licenses]
@@ -27,9 +28,9 @@ allow = [
     "MPL-2.0",
     "Zlib",
     "Unicode-3.0",
-    "Unicode-DFS-2016",
     "CC0-1.0",
     "Unlicense",
+    "CDLA-Permissive-2.0",  # webpki-roots
 ]
 
 # Ring uses a custom license
@@ -40,7 +41,7 @@ license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]
 
 [bans]
 multiple-versions = "warn"
-wildcards = "deny"
+wildcards = "allow"  # Allow workspace.dependencies = true pattern
 highlight = "all"
 workspace-default-features = "allow"
 external-default-features = "allow"