ci/actions: fix typo & use the original action

* Apparently GitHub Actions doesn't work like I expected it would with
  job forks. Revert to the original.
* Fix the `actions/checkout` type.

.cargo/audit.toml

@@ -1,4 +1,8 @@
 [output]
 quiet = false
-deny = ["warnings"]
-informational_warnings = ["unmaintained", "unsound"]
+deny = [
+    "unmaintained",
+    "unsound",
+    "warnings",
+    "yanked",
+]

.github/workflows/audit.yml

@@ -0,0 +1,17 @@
+name: Audit for RUSTSEC advisories
+
+on:
+  push:
+    branches: main
+  schedule:
+    - cron: '0 0 * * *'
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v1
+      - uses: actions-rs/audit-check@v1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+

.gitignore

@@ -1,2 +1 @@
 /target
-/Cargo.lock

.gitsigners

@@ -0,0 +1 @@
+aydin@mercan.dev sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAILLr2NFDIXvtO32wLsdMaycO7jYHjd1tydv3ClA7B/yxAAAAB3NzaDpnaXQ=

README.md

@@ -9,6 +9,16 @@ Use and extend BearSSL in Rust.
 * `bearssl`: Higher level code for easier use in servers, clients, etc.
     * Versions below `0.0.2` are unrelated to this crate.
 
+## Development
+
+We prefer commit signing via SSH. The allowed signers are listed in `.gitsigners`.
+To verify, a gitconfig entry such as the following is likely needed:
+
+```ini
+[gpg.ssh]
+    allowedSignersFile = .gitsigners
+```
+
 ## License
 
 All crates in this repository are available under `BSD-3-Clause`.