Security audit workflow still filters pushes to master

The repository uses `main`, but `.github/workflows/audit.yml` still limits its `push` trigger to `master`.

As a result, changes to `Cargo.toml` on `main` do not trigger the security audit; only the scheduled run does. The workflow was introduced in #135 with `main` as the PR base, so this appears to have been stale from the start.

The branch filter should use `main` (or be removed if the audit should run on dependency changes across branches).

Open .github/workflows/audit.yml and inspect its push trigger and branch filter, then compare them with the repository's main branch and the dependency-change context in Cargo.toml. Done means pushes to main trigger the security audit as intended, or the workflow's branch behavior is deliberately broadened; verify the workflow remains valid.

Written by the indexing model from the issue text.