Bug: cargo deny ignores unsound = "workspace" setting

### Describe the bug I would like `cargo deny` to only warn me about direct dependencies. According to [the documentation](https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html#the-unsound-field-optional), `unsound = 'workspace'` should be the default and should do the following: > Unsound advisories will only fail if they apply to a crate which is a direct dependency of one or more workspace crates. My experience using 0.19 is that the actual behavior is `unsound = 'all'`: > Any crate that matches an unsound advisory will fail ### To reproduce In the following, we create a crate that depends on `sequoia-ipc` 0.36.0, which depends on `capnp` 0.19.8 for which there is a security advisory. My expectation is that since `capnp` is not a direct dependency, `cargo deny` will not error out, but it does. ``` $ cargo init demo $ cd demo $ cargo add sequoia-ipc@0.36.0 $ cargo update -p sequoia-ipc --precise 0.36.0 Updating crates.io index ... Downgrading capnp v0.25.0 -> v0.19.8 ... Downgrading sequoia-ipc v0.36.1 -> v0.36.0 ... $ cargo deny check advisories 2026-02-10 16:14:18 [WARN] unable to find a config path, falling back to default config error[vulnerability]: Unsound APIs of public `constant::Reader` and `StructSchema` ┌─ /tmp/demo/Cargo.lock:20:1 │ 20 │ capnp 0.19.8 registry+https://github.com/rust-lang/crates.io-index │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected │ ├ ID: RUSTSEC-2025-0143 ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2025-0143 ├ The safe API functions `constant::Reader::get` and `StructSchema::new` rely on `PointerReader::get_root_unchecked`, which can cause undefined behavior (UB) by constructing arbitrary words or schemas. ## `Reader::get` ```rust pub fn get(&self) -> Result<<T as Owned>::Reader<'static>> { // ... // UNSAFE: access `words` without validation } ``` ## `StructSchema::new` ```rust pub fn new(builder: RawBrandedStructSchema) -> StructSchema { // ... // UNSAFE: access encoded nodes without validation } ``` This vulnerability allows safe Rust code to trigger UB, which violates Rust's safety guarantees. The issue is resolved in version `0.24.0` by making constructor functions unsafe and mark the fields of struct as visible only in the crate. ├ Announcement: https://github.com/capnproto/capnproto-rust/issues/605 ├ Solution: Upgrade to >=0.24.0 (try `cargo update -p capnp`) ├ capnp v0.19.8 ├── capnp-futures v0.19.1 │ └── capnp-rpc v0.19.5 │ └── sequoia-ipc v0.36.0 │ └── demo v0.1.0 └── capnp-rpc v0.19.5 (*) advisories FAILED $ echo -e "[advisories]\nunsound = 'workspace'" > deny.toml $ cargo deny check advisories error[vulnerability]: Unsound APIs of public `constant::Reader` and `StructSchema` ┌─ /tmp/demo/Cargo.lock:20:1 │ 20 │ capnp 0.19.8 registry+https://github.com/rust-lang/crates.io-index │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected ... advisories FAILED ... ### cargo-deny version cargo-deny 0.19.0 ### What OS were you running cargo-deny on? Linux ### Additional context _No response_