dependabot: ignore cross-generation RustCrypto and rand bumps

aes 0.9 / cbc 0.2 / hmac 0.13 belong to the next RustCrypto trait
generation and cannot interoperate with the cipher 0.4 / digest 0.10
stack that p256, aes-gcm, scrypt, and sha2 currently pin; rand 0.9+
is incompatible with rsa 0.9. Dependabot opened single-crate bumps for
each, which can never build — ignore them until the stacks can move
together, with the reasoning recorded in the config.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: framefilter

.github/dependabot.yml

@@ -16,3 +16,19 @@ updates:
     groups:
       cargo-minor:
         update-types: [minor, patch]
+    ignore:
+      # The CTAP crypto stack (p256, aes-gcm, scrypt, sha2) is built on the
+      # cipher 0.4 / digest 0.10 RustCrypto trait generation. aes 0.9+,
+      # cbc 0.2+, and hmac 0.13+ belong to the next generation and cannot
+      # interoperate with it; drop these ignores when bumping the whole
+      # RustCrypto stack together.
+      - dependency-name: aes
+        versions: ['>=0.9']
+      - dependency-name: cbc
+        versions: ['>=0.2']
+      - dependency-name: hmac
+        versions: ['>=0.13']
+      # rsa 0.9 (keyroost-rsakey's scoped exception) requires the rand 0.8 /
+      # rand_core 0.6 interfaces; drop when a rand-0.9+-compatible rsa ships.
+      - dependency-name: rand
+        versions: ['>=0.9']