Roll back hashbrown dependency to 0.16.

Wgpu doesn't specifically need 0.17, and Firefox would like to avoid
auditing 0.16 -> 0.17 for a little while longer.

Adjust `.deny.toml` to permit `foldhash` v0.1.5, as depended upon by
`hashbrown` `0.15.5`.

Author: jimblandy

.deny.toml

@@ -60,6 +60,9 @@ skip = [
 
     # gpu-descriptor and petgraph use an old version
     { name = "hashbrown", version = "0.15.5" },
+
+    # Used by hashbrown 0.15.5
+    { name = "foldhash", version = "0.1.5" },
 ]
 wildcards = "deny"
 allow-wildcard-paths = true

Cargo.lock

@@ -131,7 +131,7 @@ futures-lite = "2"
 glam = "0.32.0"
 glob = "0.3"
 half = { version = "2.5", default-features = false } # We require 2.5 to have `Arbitrary` support.
-hashbrown = { version = "0.17", default-features = false, features = [
+hashbrown = { version = "0.16", default-features = false, features = [
     "default-hasher",
     "inline-more",
 ] }