fix(deps): bump rustls to 0.23.45 for RUSTSEC-2026-0285

[BryanFRD]

Closes #1074.

Bumps rustls 0.23.43 to 0.23.45 for RUSTSEC-2026-0285. cargo update -p rustls moved nothing else in Cargo.lock.

fix rather than chore on purpose: rustls is in the path of every HTTPS call the binary makes, so the patched version should ship in a release rather than sit on main.

Supply chain

cargo vet is a hard gate for a human-authored PR, and rustls was exempted at exactly 0.23.43. Two changes under supply-chain/:

• config.toml: the rustls exemption moves to 0.23.45. This keeps rustls at the trust level it already had, exempted rather than audited. It does not claim anyone reviewed the 0.23.43 to 0.23.45 delta. cargo vet suggested a certify, and I did not record one, since that would assert a review of TLS code that did not happen. If you want it audited properly, cargo vet diff rustls 0.23.43 0.23.45 is the starting point.
• imports.lock: refreshed publisher data for toml_edit, ureq and ureq-proto. Unrelated to rustls, and included because main is already stale here: those three versions are already on main, and cargo vet --locked fails on main today. CI never noticed because it runs cargo vet without --locked, which refetches. This is exactly the file cargo vet wrote.

The pre-existing "unnecessary exemptions" warning is left alone, pruning is a separate change.

Verification

$ cargo audit --deny warnings
    Scanning Cargo.lock for vulnerabilities (316 crate dependencies)
$ cargo vet --locked
Vetting Succeeded (158 fully audited, 1 partially audited, 155 exempted)
$ cargo deny --all-features check
advisories ok, bans ok, licenses ok, sources ok
$ cargo test
2375 passed (3 suites)

[ferrfleet]

Checked the bump against upstream sources:

• RUSTSEC-2026-0285 is patched in >=0.23.45, affected range >=0.23.13, <0.23.45, so 0.23.45 is the minimum fix and no config change is needed alongside it.
• The new Cargo.lock checksum 0d41d731...48d634 matches what crates.io reports for rustls 0.23.45 (published by ctz, not yanked). The package's dependency list is unchanged, so nothing else entered the tree. Only one rustls entry exists in the lockfile.
• The three refreshed imports.lock publisher entries match crates.io exactly: toml_edit 0.25.15+spec-1.1.0 / 2026-09-11 / epage, ureq 3.4.1 and ureq-proto 0.6.2 / 2026-09-06 / algesten. All three versions are the ones in Cargo.lock at this head, so the file is consistent with the lock rather than ahead of it.
• The encoding_rs wildcard audit that also moved (end date to 2027-09-07, shortened notes) is byte-identical to Mozilla's current supply-chain/audits.toml. It is a refetch, not an edit.

Keeping rustls exempted rather than certifying an unreviewed TLS delta is the right call.

Nit, and out of scope for this PR: .github/workflows/ci.yml runs cargo vet with no --locked, which is why main can carry a stale imports.lock indefinitely. Adding --locked makes the gate reproducible and catches this drift at the commit that causes it; the cost is that every dependency bump that pulls in new publisher data must also commit the refreshed imports.lock, as this one does. Worth doing given vet is treated as a hard gate for human-authored PRs.

[github-actions]

SonarQube — aucune nouvelle issue

_{Comparaison entre le projet bac à sable de cette PR et la branche par défaut : SonarQube Community n'analyse pas les PR, ce delta est calculé côté CI. Détail}