chore(deps): refresh lockfile off RUSTSEC advisories

[dekobon]

Why

Every open dependabot PR (#274, #275, #276, #277, #278, #280) is red, and none
of them are at fault. They all fail the same two checks — Build & Test and the
ci aggregate gate — at the cargo-deny step, on two advisories that live in
main's Cargo.lock:

Advisory	Crate	On main	Fixed in
RUSTSEC-2026-0258 (vulnerability) — unbounded empty DATA frames	h2	0.4.13	≥ 0.4.16
RUSTSEC-2026-0253 (unsound) — use-after-free in LruCache::pop	lru	0.16.4	≥ 0.18.2

cargo-deny runs before the test and build steps, so on those six PRs the tests
never executed at all. Main is stale-green: its last CI run was 2026-08-08,
before either advisory was published.

What

• lru cannot be bumped on its own. aws-sdk-s3 pinned lru ^0.16.3 until
  1.144.0, so the fix necessarily carries aws-sdk-s3 1.137.0 → 1.144.0 and
  aws-config 1.8.18 → 1.11.0. rustls stays on a single 0.23.x line, so the
  deny.toml bans on rustls < 0.23 / rustls-webpki < 0.103 are untouched.
  The refresh also moves chacha20 off the yanked 0.10.0, clearing the last
  cargo-deny warning.
• MSRV 1.94 → 1.96. aws-sdk-s3 1.144.0 and aws-config 1.11.0 require
  1.94.1, and kstring 2.0.3 (transitive, via gix-attributes) requires 1.96.
  Raising the floor keeps the lockfile on the newest release of each rather than
  pinning dependencies back. The declared floor is truthful: the maximum
  rust_version across the entire dependency graph is kstring at 1.96.0.
• resolver.incompatible-rust-versions = "fallback". Cargo's resolver
  ignores rust-version by default — a plain cargo update on a newer local
  stable silently selected kstring 2.0.3+, and the break was invisible until it
  ran under CI's toolchain. kstring lifted its own floor from 1.73 to 1.96 in a
  patch release, which the dependabot semver-major ignore rule does not and
  cannot catch. With this set, cargo update now reports "latest Rust 1.96
  compatible versions".
• Two Rust 1.98 clippy lints. Neither exists in CI's toolchain; both fail
  make pre-commit on a current local stable. useless_borrows_in_formatting
  (8× redundant & in format! args) is fixed outright.
  unused_async_trait_impl on AzureStore::from_remote_url is allowed instead —
  the async there is deliberate and documented, and 1.96 rejects the newer lint
  name as unknown, so unknown_lints is what keeps one attribute valid on both.

No workflow edit is needed: ci.yml's derive-toolchain job reads
rust-version from Cargo.toml via cargo metadata, so the new floor
propagates everywhere on its own.

Verification

Run locally against CI's exact toolchain (1.96) and CI's pinned cargo-deny
(0.18.9) — a newer local cargo-deny does not flag RUSTSEC-2026-0253 at all, and
a newer local rustc reports lints CI never sees.

Check	Result
make ci on 1.96	passed
make pre-commit on stable 1.98	passed
cargo deny check advisories bans licenses sources @ 0.18.9	all ok, zero warnings
Rust tests	1263 passed, 0 failed
Integration (S3 / RustFS)	41 passed, 0 failed
Integration (Azure / Azurite)	41 passed, 0 failed
cargo build --workspace --locked (msrv job)	passed

Commits are ordered so each one builds standalone — the MSRV bump precedes the
lockfile refresh, since the new lock requires 1.96. Spot-checked by building at
each intermediate commit.

After this lands

• ci: bump the actions group across 1 directory with 4 updates #280 (GitHub Actions group) touches no Cargo.lock and will merge normally
  after a rebase.
• chore: bump async-trait from 0.1.89 to 0.1.92 #274–chore: bump time from 0.3.54 to 0.3.55 #278 target versions this refresh already includes, so dependabot should
  close them itself once rebased.