Compare to merge base in Cargo dependencies CI

## What problem does this solve or what need does it fill?

This workflow seems less useful than it could be right now.

- Dependencies might do minor updates that trigger failures in this CI outside of a PR author's control. The CI is only run when `Cargo.toml` is updated, so when a PR author dares touch that file, they are assaulted by any built-up new duplicates. This is entirely out of their control so it is ignored.

- There are a bunch of known duplicate dependencies that are difficult to fix and that we have decided to live with, but `deny.toml` is hard to keep up to date. When a PR author sees dependency CI failures, they have to wade through a massive error message to figure out if they have done something wrong. This makes it very easy for actual problems to slip through.

See #11962, #11966 for a recent examples in the wild of PR authors having to deal with this.

## What solution would you like?

I think it might be possible to run `cargo deny` on
- The merge base of the PR
- The PR

And compare the output of both, giving the PR author feedback only if their specific changes resulted in a new banned crate or duplicate dependency being added.

We would also want to run this on some sort of schedule "normally" to catch denials from minor updates in dependencies.

## What alternative(s) have you considered?

Keep `deny.toml` up to date, but also track duplicate dependencies that need to be fixed in GitHub issues?

## Additional context

I am not super familiar with this tooling. Is something like this possible?