cargo-deny warnings now when building variants with in-tree kit

Hi!

Finder of edge cases here.
We build our variants with an in-tree kit. Between 0.7.1 and 0.10.0 you introduced some difference in the cargo-deny run, which now results in these warnings when building the variants.

```
[2025-05-13T11:57:04Z DEBUG twoliter__bin::common] Running: Command { std: "cargo" "make" "--disable-check-for-updates" "--makefile" "/home/mikn/.cache/bazel/_bazel_mikn/2c3f33a86f4a406b8ffa9b29662db437/execroot/_main/platform/base/bottlerocket/build/tools/Makefile.toml" "--cwd" "/home/mikn/.cache/bazel/_bazel_mikn/2c3f33a86f4a406b8ffa9b29662db437/execroot/_main/platform/base/bottlerocket" "-e=TLPRIVATE_SDK_IMAGE=public.ecr.aws/bottlerocket/bottlerocket-sdk:v0.50.1" "-e=BUILDSYS_OUTPUT_GENERATION_ID=1" "-e=TWOLITER_TOOLS_DIR=/home/mikn/.cache/bazel/_bazel_mikn/2c3f33a86f4a406b8ffa9b29662db437/execroot/_main/platform/base/bottlerocket/build/tools" "-e=BUILDSYS_ARCH=x86_64" "-e=BUILDSYS_VARIANT=metal-k8s-1.31-storage" "-e=BUILDSYS_VERSION_IMAGE=1.2.2" "-e=GO_MODULES=" "-e=BUILDSYS_UPSTREAM_SOURCE_FALLBACK=false" "build", kill_on_drop: false }
warning[unmatched-skip-root]: skip tree root was not found in the dependency graph
┌─ /tmp/sources/deny.toml:69:15
│
69 │ { name = "migration-helpers" },
│ ━━━━━━━━━━━━━━━━━ no crate matched these criteria

warning[unmatched-source]: allowed source was not encountered
┌─ /tmp/sources/deny.toml:88:6
│
88 │ "https://github.com/bottlerocket-os/bottlerocket",
│ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ no crate source matched these criteria

warning[license-not-encountered]: license was not encountered
┌─ /tmp/sources/deny.toml:20:6
│
20 │ "OpenSSL",
│ ━━━━━━━ unmatched license allowance

Blocking waiting for file lock on build directory
Compiling metal-k8s-1_31-storage v0.1.0 (/home/mikn/devel/molnett/src/platform/base/bottlerocket/variants/metal-k8s-1.31-storage)
warning: metal-k8s-1_31-storage@0.1.0: Image feature EROFS_ROOT_PARTITION is experimental; use at your own risk!
Finished `dev` profile [optimized] target(s) in 6m 43s
[cargo-make] INFO - cargo make 0.37.24
[cargo-make] INFO -
[cargo-make] INFO - Build File: /home/mikn/.cache/bazel/_bazel_mikn/2c3f33a86f4a406b8ffa9b29662db437/execroot/_main/platform/base/bottlerocket/build/tools/Makefile.toml
[cargo-make] INFO - Task: build
[cargo-make] INFO - Profile: development
[cargo-make] INFO - Running Task: setup
[cargo-make] INFO - Running Task: setup-build
[cargo-make] INFO - Running Task: fetch-sdk
[cargo-make] INFO - Running Task: fetch-sources
[cargo-make] INFO - Running Task: fetch-vendored
[cargo-make] INFO - Running Task: check-licenses
bans ok, licenses ok, sources ok
[cargo-make] INFO - Running Task: build-sbkeys
[cargo-make] INFO - Running Task: publish-setup
11:57:11 [INFO] Found infra config at path: /home/mikn/devel/molnett/src/platform/base/bottlerocket/Infra.toml
[cargo-make] INFO - Running Task: cargo-metadata
[cargo-make] INFO - Running Task: validate-kits
[cargo-make] INFO - Running Task: build-variant
[cargo-make] INFO - Build Done in 410.68 seconds.
```

We depend on your migration helpers from the bottlerocket repository directly, we do not get these warnings when building the kit that our variant uses.

I added in the cargo-make output also, as I found it interesting that the output from deny comes before the cargo task `check-licenses` (which in turn outputs that it is fine).

Start by comparing the cargo-deny behavior between versions 0.7.1 and 0.10.0, using the reported cargo-make build output and the deny.toml entries at lines 20, 69, and 88. Trace why the warnings appear before the check-licenses task, then verify that building an in-tree kit no longer produces unmatched-license, skipped-root, or source warnings.

Written by the indexing model from the issue text.