fix(deps): migrate to stable pkcs5 / pkcs8 / ed25519 and loosen prerelease pins

Renames the rc.13 pkcs5 call site to its 0.8.0 stable name and drops the
`=` constraints introduced by 2a49916 (#697) on the RustCrypto prerelease
stack. Downstream consumers that bring in newer rsa rc.X (or 0.10.0
stable, when it lands) can now resolve russh cleanly without a
[patch.crates-io] override.

Source change in russh/src/keys/format/pkcs8.rs:

    pkcs5::pbes2::Parameters::pbkdf2_sha256_aes256cbc(rounds, &salt, iv)

becomes

    pkcs5::pbes2::Parameters::generate_pbkdf2_sha256_aes256cbc(rounds, &salt, iv)

Floor bumps in russh/Cargo.toml:

    crypto-bigint        0.7.0-rc.28  ->  0.7.3
    ecdsa                0.17.0-rc.16 ->  0.17.0-rc.18
    ed25519-dalek        3.0.0-pre.6  ->  3.0.0-pre.7
    elliptic-curve       0.14.0-rc.28 ->  0.14.0-rc.32
    p256 / p384 / p521   0.14.0-rc.7  ->  0.14.0-rc.9
    pkcs5                0.8.0-rc.13  ->  0.8 (stable)
    pkcs8                0.11.0-rc.11 ->  0.11 (stable)
    rsa                  0.10.0-rc.16 ->  0.10.0-rc.18
    spki                 0.8.0-rc.4   ->  0.8 (stable)

The `=` prefix is dropped on every line above. Each floor is the first
version of the crate that compiles against the stable formats family.
The cascade is forced by rsa 0.10.0-rc.16 source failing against
pkcs8 0.11.0 stable (same `KeyMalformed` enum-variant rename that broke
ed25519-rc.4 in the #697 report) and primefield 0.14.0-rc.7 failing
against crypto-bigint 0.7.3.

Other prerelease pins (aead, aes-gcm, curve25519-dalek, ml-kem,
num-bigint fork, pkcs1) are left untouched. Each one's latest published
version matches the pinned version today, so loosening would be a no-op
for resolution.

Gates run on this branch with rustc 1.88.0 (the rust-toolchain.toml
floor):

    cargo build --workspace                                   clean
    cargo build --workspace --all-features                    clean
    cargo clippy --workspace -- -D warnings                   clean
    cargo clippy --workspace --all-features -- -D warnings    clean
    cargo fmt --check                                         clean
    cargo test --workspace                                    76 lib tests +
                                                              all submodule
                                                              and doc-tests
                                                              pass
    cargo test --workspace --all-features                     77 lib tests +
                                                              all submodule
                                                              and doc-tests
                                                              pass

Author: simon-escapecode

russh/Cargo.toml

@@ -47,15 +47,15 @@ cipher = "0.5.1" # only pinned due to a cargo-minimal-versions failure in 0.5.0
 ctr = "0.9"
 ctr_0_10 = { package = "ctr", version = "0.10.0" }
 curve25519-dalek = "=5.0.0-pre.6"
-crypto-bigint = { version = "=0.7.0-rc.28", features = ["alloc"] }
+crypto-bigint = { version = "0.7.3", features = ["alloc"] }
 data-encoding = "2.3"
 delegate.workspace = true
 digest.workspace = true
 der = "0.8"
 des = { version = "0.8.1", optional = true }
-ecdsa = "=0.17.0-rc.16"
-ed25519-dalek = { version = "=3.0.0-pre.6", features = ["alloc", "rand_core", "pkcs8"] }
-elliptic-curve = { version = "=0.14.0-rc.28", features = ["ecdh"] }
+ecdsa = "0.17.0-rc.18"
+ed25519-dalek = { version = "3.0.0-pre.7", features = ["alloc", "rand_core", "pkcs8"] }
+elliptic-curve = { version = "0.14.0-rc.32", features = ["ecdh"] }
 enum_dispatch = "0.3.13"
 flate2 = { version = "1.0.15", optional = true }
 futures.workspace = true
@@ -78,19 +78,19 @@ module-lattice = "0.2"
 num-bigint = { package = "internal-russh-num-bigint", version = "=0.5.0", features = ["rand_0_10"] }
 num_bigint_0_4 = { package = "num-bigint", version = "0.4.6" }
 # num-integer = "0.1"
-p256 = { version = "=0.14.0-rc.7", features = ["ecdh"] }
-p384 = { version = "=0.14.0-rc.7", features = ["ecdh"] }
-p521 = { version = "=0.14.0-rc.7", features = ["ecdh"] }
+p256 = { version = "0.14.0-rc.9", features = ["ecdh"] }
+p384 = { version = "0.14.0-rc.9", features = ["ecdh"] }
+p521 = { version = "0.14.0-rc.9", features = ["ecdh"] }
 pbkdf2 = "0.12"
 pbkdf2_0_13 = { package = "pbkdf2", version = "0.13.0" }
 pkcs1 = { version = "=0.8.0-rc.4", optional = true }
-pkcs5 = "=0.8.0-rc.13"
-pkcs8 = { version = "=0.11.0-rc.11", features = ["encryption", "std"] }
+pkcs5 = "0.8"
+pkcs8 = { version = "0.11", features = ["encryption", "std"] }
 polyval = "0.7.1" # only pinned due to a cargo-minimal-versions failure in 0.7.0
 rand_core = { version = "0.10.0" }
 rand.workspace = true
 ring = { version = "0.17.14", optional = true }
-rsa = { version = "=0.10.0-rc.16", optional = true }
+rsa = { version = "0.10.0-rc.18", optional = true }
 russh-cryptovec = { version = "0.59.0", path = "../cryptovec", features = [
   "ssh-encoding",
 ] }
@@ -104,7 +104,7 @@ sha2.workspace = true
 sha2_0_11 = { package = "sha2", version = "0.11.0" }
 sha3 = "0.11.0"
 signature.workspace = true
-spki = "=0.8.0-rc.4"
+spki = "0.8"
 ssh-encoding.workspace = true
 ssh-key.workspace = true
 subtle = "2.4"

russh/src/keys/format/pkcs8.rs

@@ -129,7 +129,7 @@ pub fn encode_pkcs8_encrypted(
     rng.fill_bytes(&mut iv);
 
     let doc = pvi.encrypt_with_params(
-        pkcs5::pbes2::Parameters::pbkdf2_sha256_aes256cbc(rounds, &salt, iv)
+        pkcs5::pbes2::Parameters::generate_pbkdf2_sha256_aes256cbc(rounds, &salt, iv)
             .map_err(|_| Error::InvalidParameters)?,
         pass,
     )?;