Update dependencies affected by RustSec advisories

[tnull]

Summary

The current Cargo.lock pins versions reported by cargo audit for four
vulnerabilities and three unsoundness warnings:

• postgres-protocol 0.6.10: RUSTSEC-2026-0180 (hstore panic DoS) and
  RUSTSEC-2026-0179 (unbounded SCRAM iteration CPU DoS)
• tokio-postgres 0.7.16: RUSTSEC-2026-0178 (DataRow field-count panic DoS)
• time 0.3.45: RUSTSEC-2026-0009 (stack exhaustion DoS)
• anyhow 1.0.100: RUSTSEC-2026-0190 (Error::downcast_mut unsoundness)
• rand 0.8.5 and 0.9.2: RUSTSEC-2026-0097 (unsound reentrant custom logger
  interaction)

Observed on 88a5703496386465556d920dccf49512296c53d0 (current main). #92
covered the time advisory and led to dropping jsonwebtoken, but the locked
tree still contains time 0.3.45; the other advisories are not covered there.

Impact and reachability

The PostgreSQL advisories generally require a malicious or MITM-controlled
database backend, which is trusted infrastructure in a normal deployment. The
reported rand issue requires a custom logger that re-enters rand::rng(), a
pattern not present here, and the anyhow operation is not known to be used on
a key path. No finding here yields private keys or forged authorization.

This is therefore primarily dependency hardening, with low application-level
risk under the expected threat model.

Proof of concept

cargo audit

Run against the checked-in lockfile to reproduce the advisory list.

Suggested remediation

Update the affected dependencies/lockfile to patched releases where compatible,
then rerun cargo audit. If an advisory cannot be upgraded immediately,
document its reachability assessment and temporary ignore with an expiry.

Reported by Bitcoin Red Team.