chore(v3): backport cargo deny & update slab and replace_with

.github/workflows/deny.yml

@@ -0,0 +1,18 @@
+# This workflow will run `cargo-deny`, checking for dependency issues related to licensing, known vulnerabilities, and more.
+# The configuration file is in [deny.toml](../../deny.toml).
+name: Cargo Deny
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+  merge_group:
+
+jobs:
+  cargo-deny:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: EmbarkStudios/cargo-deny-action@v2
+      with:
+        rust-version: "1.86.0"

deny.toml

@@ -0,0 +1,22 @@
+[advisories]
+ignore = [
+  "RUSTSEC-2024-0436", # Paste is unmaintained, whatever.
+  "RUSTSEC-2025-0046", # wasmtime, only impacting WASI, tracked in https://github.com/filecoin-project/ref-fvm/issues/2186
+]
+
+[bans]
+multiple-versions = "allow"
+
+[licenses]
+allow = [
+  "Apache-2.0",
+  "Apache-2.0 WITH LLVM-exception",
+  "BSD-2-Clause",
+  "BSD-3-Clause",
+  "CC0-1.0",
+  "MIT",
+  "Unlicense",
+  "MPL-2.0",
+  "Unicode-3.0",
+  "Zlib",
+]

testing/conformance/Cargo.toml

@@ -7,6 +7,7 @@ edition.workspace = true
 exclude = ["/test-vectors"]
 publish = false
 repository = "https://github.com/filecoin-project/ref-fvm"
+license.workspace = true
 
 [dependencies]
 fvm = { workspace = true, features = ["testing"] }