After opening the issue about the heapless crate I was wondering why my CI setup didn't warn about the new advisory.

From the code it looks I need to include the "Unsound" value in the informational_warnings variable. I could only do this via the config, but I could not figure out how to do this via command line. I tried various combinations of these flags --deny-warnings --deny warnings --deny unsound --deny yanked, yet informational_warnings only ever has the value "unmaintained" and I also could not find in the code where this might be controllable via command line flags.

The default of "Unmaintained" seems to be set here:
https://github.com/RustSec/cargo-audit/blob/fd432f92df270352146f65a7cd219a5e62506587/src/config.rs#L58-L63

This piece of code checks for an exact match of the informational category, effectively hiding everything besides unmaintained unless a config file is present.
https://github.com/RustSec/rustsec-crate/blob/cac1a0bed7f0d634c1f88bb27cfa36050f055357/src/report.rs#L192-L195

How can I enable warnings for all informational advisories via the command line?
Can I specify the location of a config file via the command line?