chore(deps): bump scc 2 -> 3 and serial_test 3 -> 4 to fix RUSTSEC-2026-0205

[son-oz]

Summary

osv-scanner flags scc 2.4.0 (RUSTSEC-2026-0205). The fixed version is 3.8.4+.

Dependency path

Two consumers of scc 2.x:

scc v2.4.0
├── openzeppelin-relayer            (direct: scc = "2", used in src/services/plugins/shared_socket.rs)
└── serial_test v3.3.1              (dev-dependency)

Both must move, otherwise the vulnerable 2.x copy stays in Cargo.lock as a duplicate.

Proposed fix

Bump both in Cargo.toml:

scc = "3"            # currently "2"; adapt scc::HashMap usage in shared_socket.rs to the 3.x API if needed

[dev-dependencies]
serial_test = "4"    # currently "3"; serial_test 4.x dropped its scc dependency entirely

1. Bump both versions and cargo update scc serial_test.
2. Fix any scc::HashMap API changes in src/services/plugins/shared_socket.rs (the only usage site) and any #[serial] attribute changes in tests.
3. Verify with cargo tree -i scc — only a 3.x copy should remain (or none from serial_test).
4. Run the plugin/shared-socket tests and the full suite; re-run osv-scanner scan source ./.

Acceptance criteria

• No scc 2.x in Cargo.lock.
• RUSTSEC-2026-0205 no longer reported.
• Shared socket tests and serial tests pass.