fix(deps): remediate Rust advisories and drop deprecated rustls-pemfile

[robinnsc]

What

Remediates the open Rust dependency advisories and removes one deprecated dependency,
in a single commit rebased onto current main:

• crossbeam-epoch 0.9.18 → 0.9.20 — the fix for RUSTSEC-2026-0204.

• anyhow 1.0.102 → 1.0.103 and event-listener 5.4.1 → 5.4.2 — preferred
  direct-dependency updates. The event-listener bump also drops the transitive
  concurrent-queue crate entirely.

• rustls-pemfile removed (deprecated upstream). Both call sites
  (crates/app/src/init_helpers.rs, crates/app/src/manage_http.rs) migrate to the
  rustls-pki-types PEM API (CertificateDer::pem_slice_iter) already in the tree,
  with identical error handling and messages.

• sqlx tightened to default-features = false with the explicit feature list,
  plus derive (used by the storage backends' FromRow types). This trims unused
  default machinery from the dependency graph.

• SOFTWARE-LICENSE-NOTICES.html regenerated (second commit) with the pinned
  cargo-about 0.9.0, since the dependency changes above alter the license
  inventory: rustls-pemfile and concurrent-queue leave, three versions bump.

Net effect on Cargo.lock: zero packages added, rustls-pemfile and
concurrent-queue removed, three versions bumped. tests/rust/Cargo.lock picks up
the matching anyhow bump.

Why

The release runbook blocks the first public extenddb-postgres container image on
RUSTSEC-2026-0204: no advisory-affected version may ship in a public image. The
anyhow/event-listener bumps are the recorded preferred updates from the same
review. Dropping rustls-pemfile now, rather than later, avoids shipping the first
public artifact with a dependency that is already deprecated and would force a
post-release lockfile churn to remove.

The branch predates the MongoDB backend landing on main; it has been rebased and
the workspace Cargo.toml conflict resolved keeping both this PR's hardened sqlx
line and main's new mongodb/bson/dashmap dependencies.

Testing done

• cargo metadata --locked — lockfile is consistent with the manifests.
• cargo check --workspace --all-targets --locked — clean, including the new
  extenddb-storage-mongodb crate from post-rebase main.
• cargo test --workspace --locked — 769 passed, 0 failed across all suites.
• cargo fmt --all --check — clean.
• cargo clippy --workspace --all-targets --locked — clean, zero warnings.
• Lockfile inspected directly: resolves crossbeam-epoch 0.9.20, anyhow 1.0.103,
  event-listener 5.4.2; comm over package names confirms nothing was added.
• devtools/generate-software-license-notices --check — passes against the
  regenerated notices; spot-checked that rustls-pemfile/concurrent-queue no
  longer appear and the three bumped versions do.
• Full integration pass (devtools/run-tests --extenddb --rust-integration --pytest --release against a live server on the pinned PostgreSQL 16.10 image) is running
  at the time of writing — Python suite past 70% with zero failures so far. I will
  post the final counts as a comment when it completes.

Not verified:

• The container smoke test (ci/smoke-test-container.sh) has not been re-run for
  this change; it exercises the same binary the workspace and integration suites
  cover, and will run as part of the release process regardless.

Checklist

• I have read CONTRIBUTING.md
• All tests pass (cargo test --workspace)
• Code is formatted (cargo fmt --check)
• Clippy is clean (cargo clippy -- -W clippy::pedantic)
• I have added or updated tests for new functionality — not applicable: no new
  functionality; existing tests cover the migrated PEM-parsing call sites
• I have updated documentation if behavior changed — not applicable: no behavior
  change
• Breaking changes are noted below (if any)
• If this changes the wire protocol, Storage trait, auth model, on-disk
  format, or public CLI surface, an RFC has been accepted or is linked
  below. Otherwise, an ADR captures the decision (link below).

ADR / RFC: n/a — dependency maintenance only; no wire protocol, Storage trait,
auth model, on-disk format, or CLI surface change.

Breaking changes

None. Public behavior is unchanged: the PEM-parsing migration is call-site-for-call-site
with the same error text, and the sqlx feature trim keeps every feature the
workspace actually uses (verified by the clean workspace check and test run,
including the SQLite and MongoDB backends).

---

By submitting this pull request, I confirm that my contribution is made under
the terms of the Apache License 2.0 and I agree to the Developer Certificate of
Origin (DCO). See CONTRIBUTING.md for details.

[LeeroyHannigan]

LGTM