Ports license-compliance.yml, security-scan.yml, processing-conformance.yml
and web-routes.yml after the GitHub account was suspended and Actions
stopped being reachable.
The matrices become parallel:matrix over the same crate and module
directories, and cargo-deny-action becomes cargo-deny installed in the job,
since it has no GitLab equivalent. The command lines are unchanged,
including the allowed-licence and ignore lists: that is licence policy, not
configuration, and it must not drift silently.
One real difference: check-tenant-boundary.sh and check-web-routes.sh shell
out to go. The Actions runner happened to have a toolchain on PATH so the
workflow never said so; here they run on the Go image.
The Actions workflows stay in the tree as the reference.
