Bump rustls-webpki and tokio past RUSTSEC-2026-0382/0386
make release VERSION=0.3.0 fails in rs-check -> deny on RustSec advisories in both rust/Cargo.lock and conformance/runner/rust/Cargo.lock. Lockfile-only bumps; no other crates move:
| Advisory | Crate | From | To |
|---|---|---|---|
| RUSTSEC-2026-0382 | rustls-webpki | 0.103.15 | 0.103.16 |
| RUSTSEC-2026-0386 (unsound) | tokio | 1.53.2 | 1.54.1 |
| RUSTSEC-2026-0383 | webpki-root-certs | 1.0.9 | 1.0.11 |
The third one surfaced only once the first two cleared; it's dev-only (reqwest -> rustls-platform-verifier) but still fails deny, so it's included here.
Verified locally: make rs-check rs-test passes, and cargo deny check advisories reports advisories ok for both workspaces. basecamp-sdk and hey-sdk already carry patched versions on their default branches.
Summary by cubic
Bumps rustls-webpki, tokio, and webpki-root-certs in both rust/Cargo.lock and conformance/runner/rust/Cargo.lock to clear RustSec advisories that fail cargo deny during the release gate.
rustls-webpki0.103.15 → 0.103.16 (RUSTSEC-2026-0382)tokio1.53.2 → 1.54.1 (RUSTSEC-2026-0386, unsound)webpki-root-certs1.0.9 → 1.0.11 (RUSTSEC-2026-0383; dev-only, viareqwest'srustls-platform-verifier)
Lockfile-only bumps; no other crates move. Verified make rs-check rs-test passes and cargo deny check advisories reports ok for both workspaces.