CI checks for build, test, lint, and dep vulnerabilities

[emostov]

Closes #11
Closes #32

All non-ci diff comes from addressing clippy errors.

[keyz]

Would it make sense for "Checkout + fetch dependencies" to be a separate job, and have other jobs depend on that? I guess this way we can use Cargo.lock as the key for caching the toolchain and dependencies across CI runs

[emostov]

If we could "Checkout + fetch dependencies" and then have subsequent jobs run in the same environment it makes sense because it saves us for having to do it for each. But AFAICT every job runs in its own environment so it won't save us any time but instead just make sure subsequent jobs don't run if it fails?

[keyz]

Yup every job runs in its own environment, however there's a ~global cache that every job can read/write. I think we can have the "checkout + fetch" job write to the cache, then let other jobs restore the cache: maybe something like this