Refresh Cargo.lock to clear RustSec advisories

[joh-klein]

cargo audit against the current Cargo.lock (at 06a358f) reports 6 vulnerabilities. This PR bumps four dependencies to their latest semver-compatible versions to clear all of them. Only Cargo.lock changes — no Cargo.toml edits, no major-version bumps.

Updates

bytes         1.10.1  -> 1.12.1
rustls        0.23.31 -> 0.23.42
rustls-webpki 0.103.4 -> 0.103.13
time          0.3.44  -> 0.3.53

(plus the transitive deranged, num-conv, time-core, time-macros that time pulls forward)

Cleared advisories

Crate	Advisory	Issue
bytes	RUSTSEC-2026-0007	Integer overflow in BytesMut::reserve
rustls-webpki	RUSTSEC-2026-0049	CRLs not considered authoritative by Distribution Point
rustls-webpki	RUSTSEC-2026-0104	Reachable panic in CRL parsing
rustls-webpki	RUSTSEC-2026-0099	Name constraints accepted for wildcard name
rustls-webpki	RUSTSEC-2026-0098	Name constraints for URI names incorrectly accepted
time	RUSTSEC-2026-0009	DoS via stack exhaustion

Verification

cargo audit   # before: error: 6 vulnerabilities found!
              # after:  0 vulnerabilities
cargo build   # Finished dev profile

Out of scope

cargo audit still emits its 2 pre-existing allowed warnings (lru RUSTSEC-2026-0002, rand RUSTSEC-2026-0097) — unsoundness advisories, not vulnerabilities, and already whitelisted. Left untouched to keep this PR to the security bumps.