Vulnerable `quick-xml` 0.38 — two HIGH RustSec advisories

[g-pichler]

Cargo.toml pins quick-xml = "0.38" → locked to 0.38.4, affected by two HIGH DoS advisories (both fixed in 0.41.0):

Advisory	Issue
RUSTSEC-2026-0194	Quadratic runtime on duplicate attribute-name check → CPU DoS
RUSTSEC-2026-0195	Unbounded namespace allocation in NsReader → memory DoS

Both reachable when parsing untrusted XSD/XML. cargo deny check advisories flags them.

Fix: bump workspace dep to quick-xml = "0.41" and update Cargo.lock

[Bergmann89]

Hey @g-pichler,

thanks for reporting. I'll have a look and try to fit it over the weekend.