fix: clear 3 RUSTSEC advisories via dep bumps + ignore-list sync (#110)

Three-part fix for #102 (originally scoped to rand; expanded to clear
two adjacent advisories that surfaced once rand was no longer the
loudest noise in cargo audit):

1. `cargo update -p rand@0.9.2` → 0.9.4. Clears RUSTSEC-2026-0097
   for the 0.9.x instance (pulled via uuid, quinn-proto, debugid).
2. `cargo update -p wasmtime@43.0.1` → 43.0.2. Clears RUSTSEC-2026-0114
   (panic on table allocation exceeding host address space).
3. `cargo update -p rustls-webpki` → 0.103.13. Clears RUSTSEC-2026-0104
   (reachable panic in CRL parsing).

All three are within-minor patch bumps; no Cargo.toml edits needed
because the existing version constraints were range-compatible.

The residual `rand 0.8.5` transitive (via regorus 0.2.8 policy engine)
cannot be patched without an upstream regorus release that bumps to
rand 0.9+. wsc does not use custom rand loggers, so the unsoundness
from RUSTSEC-2026-0097 does not affect us. deny.toml already had this
ignore; this commit adds the matching `--ignore RUSTSEC-2026-0097`
flag to the cargo-audit CI step so the two ignore lists stay aligned.

Effect:
  before: cargo audit → 4 vulnerabilities (rand x2, wasmtime, webpki)
  after:  cargo audit → 0 vulnerabilities (with --ignore list applied)

Fixes: #102

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: avrabe

.github/workflows/supply-chain.yml

@@ -47,6 +47,11 @@ jobs:
     - name: Install cargo-audit
       run: cargo install --locked cargo-audit
     - name: Run cargo audit
+      # Ignore list stays in sync with deny.toml [advisories].ignore.
+      # RUSTSEC-2026-0097 (rand): bumped to 0.9.4 in this branch to clear
+      # the 0.9.x instance; the residual 0.8.5 transitive via regorus
+      # cannot be patched until regorus 0.3+ ships. wsc does not use
+      # custom rand loggers, so the unsoundness does not affect us.
       run: |
         cargo audit \
           --ignore RUSTSEC-2025-0046 \
@@ -56,7 +61,8 @@ jobs:
           --ignore RUSTSEC-2026-0021 \
           --ignore RUSTSEC-2025-0057 \
           --ignore RUSTSEC-2025-0134 \
-          --ignore RUSTSEC-2024-0436
+          --ignore RUSTSEC-2024-0436 \
+          --ignore RUSTSEC-2026-0097
 
   cargo-deny:
     name: Cargo Deny