The SSH transport moves from aws-lc-rs to ring. The default build now links no
aws-lc at all and is 23.5% smaller: 9,816,520 -> 7,505,472 bytes, with build
artifacts dropping from 240 MB of aws-lc-sys directories to ring's 21 MB.

TLS deliberately keeps aws-lc. ring offers neither X25519MLKEM768 nor
ECDSA_NISTP521_SHA512, and `tls` is a non-default feature, so the ordinary
build is already ring-only and gets the whole reduction; only a caller opting
into NETCONF-over-TLS links aws-lc, and gets those capabilities for it.

Minor rather than patch because which provider a consumer links, and therefore
which algorithms the SSH transport can offer, is not a patch-level detail.

Also: the rustls provider choice is now actually ours (tokio-rustls default
features were silently forwarding aws_lc_rs); argon2 and blake2 are off release
candidates, leaving ssh-key 0.7.0-rc.11 as the last prerelease; the CLI drops
`colored` for `console::style`.

cli and yang move only to require rustnetconf 0.17.0 exactly.

Exercised against vSRX 24.4R1.9. Not proven end-to-end against SRX345
21.2R3-S6.11, so #77 stays open — though 21.2's SSH algorithm offer is a strict
superset of 24.4's, recorded on the issue.