ci: add cargo fmt and clippy workflow (#53)

Adds a GitHub Actions workflow running `cargo fmt --all -- --check` and
`cargo clippy --all-targets --all-features --workspace -- -D warnings`
on pushes to main and pull requests.

Rust is installed with `rustup` because the ASF action allowlist only
permits `dtolnay/rust-toolchain` at a pinned SHA.

Note: the workspace `Cargo.toml` is not on `main` yet (#45), so the
clippy job needs that to merge first. I haven't run clippy locally
against the current tree, so existing warnings may need fixing before
this goes green.