Update dependencies and use more specific versions for dependencies with known CVEs

[jsdanielh]

What's in this pull request?

• Use a more specific version for the rand_core dependency than versions with known CVEs.
  This fixes rand_core in keys should use a more specific version greater than known CVE #2454.
• Use a more specific version for the futures-util dependency than versions with known CVEs.
  This fixes futures-util in web-client should use a more specific version greater than known CVEs #2457.
• Use a more specific version for the tracing dependency than versions with known CVEs.
  This fixes tracing in network-libp2p should use a more specific version greater than known CVE #2453.
• Use a more specific version for the regex dependency than versions with known CVEs.
• Update the itertools dependency to the latest version (0.12.1) as for some reason this hasn't been flagged by GH dependabot.
• Update the hyper dependency to the latest version (1.3.1) for the metrics-server subcrate.
• Updated the crossbeam-channel dependency from version 0.5.7 to 0.5.12 (latest) since the former version was already yanked as pointed by cargo audit.
• Switch to a maintained version of the dotenv dependency: dotenvy since the former is flagged by cargo audit as unmaintained.
• Switch to a maintained version of the ansi-term dependency: ansiterm since the former was flagged by cargo audit as unmaintained.
• Add Github workflow to check for security vulnerabilities using cargo audit.
  This workflow was set up to run every Wednesday at 2:00 UTC.

Pull request checklist

• All tests pass. The project builds and runs.
• I have resolved any merge conflicts.
• I have resolved all clippy and rustfmt warnings.

[hrxi]

Could we perhaps move these dependencies to the global Cargo.toml so that we don't have to update the version number in several places?

How do we notice that we specify a version in Cargo.toml that is lower than a CVE?

[Eligioo]

@hrxi deps.rs is one effort I know though it doesn't actively notify you about versions lower than a CVE. But it's a badge in the README of this repo already.

futures-util doesn't show up there for example because it's already locked at 0.3.30.

https://github.com/rustsec/audit-check might be interesting

[jsdanielh]

Could we perhaps move these dependencies to the global Cargo.toml so that we don't have to update the version number in several places?

Done. Only did it for futures and log since the rest only seemed to be use in a single crate.

How do we notice that we specify a version in Cargo.toml that is lower than a CVE?

Yeah, as @Eligioo mentioned we already have deps.rs and then there is also cargo audit which I can see if I can add it to GH actions.

[jsdanielh]

Could we perhaps move these dependencies to the global Cargo.toml so that we don't have to update the version number in several places?

Done. Only did it for futures and log since the rest only seemed to be use in a single crate.

How do we notice that we specify a version in Cargo.toml that is lower than a CVE?

Yeah, as @Eligioo mentioned we already have deps.rs and then there is also cargo audit which I can see if I can add it to GH actions.

Done. Just added a GH action that is going to be run periodically to check for cargo audit warnings.

[hrxi]

LGTM otherwise.