update CI, add `bundle-audit` and `license_finder`