chore: resolve aws-lc-rs vuln

[taddes]

Description

Updates two CVEs in aws-lc-sys showd up from a cargo audit run.

RUSTSEC-2026-0044: X.509 name constraints bypass — a TLS certificate with a wildcard or Unicode common name (CN) could circumvent name constraint validation, potentially allowing a rogue cert to be accepted as valid.
RUSTSEC-2026-0048 (high, 7.4): CRL distribution point scope logic error — incorrect scoping when checking Certificate Revocation Lists, meaning a revoked certificate might not be flagged.

Transitive deps using it:

jsonwebtoken = { ..., features = ["aws_lc_rs"] } — used for FxA JWT verification in tokenserver-auth
reqwest = { ..., features = ["rustls"] } — rustls defaults to aws-lc-rs as its crypto provider, used throughout for HTTP clients

Testing

cargo audit

Issue(s)