sdk(rust): drop hickory-dns from reqwest features

The SDK inherited the workspace `reqwest` dep, which enables
`hickory-dns` and pulls in `hickory-resolver 0.25.2` →
`hickory-proto 0.25.2`. That chain is flagged by RUSTSEC-2026-0119
(O(n^2) name compression CPU-exhaustion in hickory-proto < 0.26.1),
and there is no patched 0.25.x release.

The SDK does not need a custom DNS resolver — its only HTTP traffic is
to a local Unix socket / loopback. Pinning reqwest directly with the
workspace's other features (rustls-tls, charset) and dropping
`hickory-dns` keeps TLS/charset behavior identical and removes the
vulnerable transitive entirely from downstream consumers.

Other workspace members (gateway, kms, ...) continue to use
`reqwest = { workspace = true }` and are unaffected.

Refs: GHSA-q2qq-hmj6-3wpp

Author: carloszanella

sdk/rust/Cargo.toml

@@ -21,7 +21,7 @@ bon.workspace = true
 hex = { workspace = true, features = ["std"] }
 http.workspace = true
 http-client-unix-domain-socket = "0.1.1"
-reqwest = { workspace = true, features = ["json"] }
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "charset"] }
 serde.workspace = true
 serde_json.workspace = true
 sha2.workspace = true