fix(security): resolve all audit advisories

- Cargo.lock: bump rustls-webpki 0.103.10 -> 0.103.13, patching:
  - RUSTSEC-2026-0104: reachable panic in CRL parsing (BIT STRING
    mishandling in IssuingDistributionPoint extension)
  - RUSTSEC-2026-0098: URI name constraints incorrectly accepted
  - RUSTSEC-2026-0099: wildcard name constraints incorrectly accepted

- security.yml: add RUSTSEC-2026-0097 (rand unsoundness via custom
  logger + rand::rng()) to ignore list. rand is a purely transitive
  dependency; no patched version exists for 0.8.x/0.9.x; Forge defines
  no custom logger that accesses rand::rng() so the preconditions for
  the unsoundness are never met.

Author: Theaxiom

.github/workflows/security.yml

@@ -23,7 +23,13 @@ jobs:
           # sqlx's proc-macro crate pulls unconditionally regardless of features.
           # Forge never performs RSA operations; rsa is never invoked at runtime.
           # Revisit when sqlx gates sqlx-mysql behind a feature flag.
-          ignore: RUSTSEC-2023-0071
+          #
+          # RUSTSEC-2026-0097: rand unsoundness via custom logger + rand::rng().
+          # No patched version exists for rand 0.8.x or 0.9.x. rand is a purely
+          # transitive dependency; Forge defines no custom logger that accesses
+          # rand::rng(), so the unsoundness preconditions are not met.
+          # Remove when a patched rand version is released.
+          ignore: RUSTSEC-2023-0071,RUSTSEC-2026-0097
 
   codeql:
     name: CodeQL