Drop zip default features in wslc_common to remove aes/sha1 (#698)

This PR trims wslc_common's `zip` build-dependency to the `deflate` feature
only, removing the transitive `aes` and `sha1` crates (and other unused
codecs) from the dependency graph.

Details

* wslc_common uses `zip` only in build.rs to extract NuGet `.nupkg`
  archives (standard deflate zips) via `ZipArchive` + `by_index` — it never
  reads AES-encrypted archives, so the default `aes-crypto` feature is
  unnecessary.
* Set `zip = { version = "2", default-features = false, features = ["deflate"] }`.
  This drops aes, sha1, hmac, pbkdf2, cipher, constant_time_eq, plus the
  unused bzip2/lzma/zstd/deflate64/crc/time codec chains from Cargo.lock.
* Silences the Dependabot noise around the (build-time-only, non-exploitable)
  aes/sha1 entries.

Tests

* cargo check -p wslc_common: passed (build.rs nupkg deflate extraction path
  unchanged).
* cargo clippy -p wslc_common --all-targets -- -D warnings: clean.
* Verified `cargo tree -i aes` and `cargo tree -i sha1` no longer resolve.

Co-authored-by: Gudge <gudge@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4cc05a95-546f-4acb-913a-b946127fa01f

Author: 3 people