Clear the two red checks on main: rustls advisory and rust-toolchain pin comments
Two unrelated failures keep every open PR red, including #189. Both are fixed here so #189 can go green after a rebase.
cargo deny / Rust (stable). These fail on main (the scheduled Security run on 2026-09-21) because rustls 0.23.44 is flagged by RUSTSEC-2026-0285 / GHSA-2mjx-qc3c-rqvc: it accepts TLS 1.3 handshake messages that span a key change. rustls is transitive through reqwest. make deny checks two lockfiles, the SDK's (rust/Cargo.lock) and the Rust conformance runner's (conformance/runner/rust/Cargo.lock); both get cargo update -p rustls to 0.23.45 and nothing else moves.
GitHub Actions audit. zizmor reports ref-version-mismatch on the seven dtolnay/rust-toolchain@6c977a6c… # v1 pins. That action publishes only one tag, v1, and upstream moved it to 02cb101e on 2026-09-12, so the comment names a tag that no longer resolves to the pinned sha. The sha is unchanged; only the comment changes, to # upstream moves its only tag, v1. That is basecamp-sdk#939's wording without its date: dependabot moves the sha and keeps the comment, so a date goes stale on the first bump (basecamp/basecamp-sdk#946 shows it).
Checked locally: make deny reports advisories ok, bans ok, licenses ok, sources ok for both workspaces, cargo test --locked --all-features passes, the runner builds with --locked, and zizmor .github reports no findings.
Once this merges, #189 needs a rebase (@dependabot rebase).