fix(deps): security updates (#139)

Applied available Dependabot Rust security updates via `cargo update`
(no Cargo.toml major edits, no hand-edited checksums).

## LOCKFILE A — czech-file-knife/Cargo.lock
**Fixed (in-range):**
- `aws-lc-sys` 0.36.0 -> 0.41.0 (>= patched 0.39.0; pulled in by bumping
`aws-lc-rs` 1.15.3 -> 1.17.0)
- `lz4_flex` 0.11.5 -> 0.11.6 (patched)
- `rand` 0.9.2 -> 0.9.3 (patched)

**Flagged — needs-manual-major (patched version outside current semver
range):**
- `surrealdb` 2.6.5 -> needs 3.1.5 (workspace pins `^2.6.1` via
cfk-cache; 3.x is a major bump)
- `jsonwebtoken` 9.3.1 -> needs 10.3.0 (transitively pinned `^9.3.0` by
surrealdb-core 2.6.5; blocked behind the surrealdb major bump)
- `lru` 0.12.5 -> needs 0.16.3 (pinned `^0.12.0` by tantivy 0.25.0; a
separate already-patched 0.18.0 entry also exists)

## LOCKFILE B — rescript-ecosystem/.../opsm-shell/src-tauri/Cargo.lock
- `rand` -> 0.9.3: **not applicable / flagged**. Lock contains only rand
0.7.3 and 0.8.5 (no 0.9.x present); both are pinned pre-0.9 by tauri
1.8.3 / phf_generator. Cannot introduce 0.9.3 without a major dependency
bump. No change.

## LOCKFILE C — asdf-augmenters/asdf-acceleration-middleware/Cargo.lock
- `lru` 0.12.5 -> needs 0.16.3: **flagged needs-manual-major**. The
vulnerable 0.12.5 is pinned `^0.12.0` by ratatui 0.28.1; 0.16.3 is out
of range. A separate already-patched 0.18.0 entry exists. No change.

Only Lockfile A had applicable in-range patches; B and C were left
unchanged. Do not merge without review.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath