Bump rustls past RUSTSEC-2026-0346
rustls 0.23.45 carries four RustSec advisories published on 2026-10-14 (RUSTSEC-2026-0346 among them, fixed in 0.23.46), and yoke-derive 0.8.3 was yanked. The cargo-audit gate therefore fails on main and on every open pull request, whatever the branch changes. This moves both to the patched releases in Cargo.lock only; Cargo.toml already allows them.
Verified with cargo update -p rustls -p yoke-derive, then cargo audit --file Cargo.lock, which exits 0 with no vulnerabilities (four before). cargo test --locked --lib gives 902 passed and 2 failed, and the same two gemini::tests::bounded_http_diagnostic_* tests fail identically on unmodified main on this machine, since they expect a real connect error that the local network sandbox does not produce; CI runs them green.
Summary by cubic
Fixes the failing cargo-audit gate by bumping rustls to 0.23.46 and yoke-derive to 0.8.4 in Cargo.lock. rustls 0.23.45 carries four RustSec advisories (including RUSTSEC-2026-0346) and yoke-derive 0.8.3 was yanked, so the gate failed on main and on every open PR.
Both versions are already allowed by Cargo.toml, so this is a lockfile-only change. cargo audit --file Cargo.lock now exits 0 with no vulnerabilities (four before). The two failing gemini::tests::bounded_http_diagnostic_* tests fail identically on unmodified main on this machine; they expect a real connect error the local network sandbox does not produce, and CI runs them green.