Move targets/exclude under [graph] in deny.toml

Newer cargo-deny versions emit `this key has been moved to [graph]`
deprecation warnings for `targets` and `exclude` at the root. Adding
the `[graph]` header before `targets` places both keys under the
expected section; behavior is unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: algesten

deny.toml

@@ -8,6 +8,7 @@
 
 # Note: running just `cargo deny check` without a `--target` can result in
 # false positives due to https://github.com/EmbarkStudios/cargo-deny/issues/324
+[graph]
 targets = [
   { triple = "aarch64-apple-darwin" },
   { triple = "i686-pc-windows-gnu" },