security: audit with mix hex.audit and drop mix_audit

[rubas-agent]

Before: the daily security workflow runs MIX_ENV=test mix deps.audit, which needs the mix_audit dev dependency.

Problem:

• mix_audit 2.1.5 reads only a GitHub advisory mirror. It misses the Hex advisory feed (EEF CNA).
• It pulls in yaml_elixir and yamerl for nothing else.

After: the workflow runs mix hex.audit, which reports advisories and retired packages from Hex itself (Hex 2.5.1 or newer). mix_audit, yaml_elixir, and yamerl leave mix.exs and mix.lock.

Details

• security.yml already runs mix local.hex --force, which installs the newest Hex, so CI gets 2.5.1 or newer. mix hex.audit reads the lock, so it needs no MIX_ENV=test.
• Advisories: none. No bump and no waiver.
• Checks run locally with Hex 2.5.1, Elixir 1.20.4, OTP 29.1.1:
  • mix hex.audit in the branch: No retired or security advisory packages found.
  • The audit prototype of the shared workflow (a stub project with the hexpm part of the lock): the same result.
  • mix compile --warnings-as-errors: passes.
• The reviewer checks that the Security Audit workflow still reports a failed audit as an issue; the step name did not change.