chore(deps): make a duplicate version a decision somebody wrote down (R9)

[haiquang9994]

multiple-versions was "warn", and the tree was using the allowance: cargo-deny
reports ten duplicated crates against this repository's own six targets. A warning
is a line in a CI log nobody opens.

The level is now "deny". Five skip entries and three skip-tree roots carry every
duplicate the tree has today, each naming the edge that causes it rather than saying
"upstream". The three roots collapse the nine windows-targets / windows_* leaves,
which are consequences of a windows-sys already listed and not decisions of their
own. A duplicate that is not on the list is one somebody just introduced, and the
build now stops before the merge.

The gate was watched failing before it was trusted: removing the syn entry makes
cargo deny check bans exit 2, restoring it exits 0.

Nothing could be unified. tokio, mio and socket2 are already on the same
windows-sys this workspace takes directly, so the finding's "follow upstream" had no
upstream to follow. The one duplicate that is ours to remove sits under keyring
3.6.3, and keyring 4 rebuilt every backend into a crate of its own — which moves the
direct edge ADR 0013 depends on. That is a migration, left as its own work.

Two manifest comments disagreed with the tree and now do not. getrandom is not
already present "through rustls and sqlx": both reach it only through cc's jobserver
at build time, while rand and tempfile are the run-time edges that make the claim
true. And rcgen's default ring backend is not one "rustls already puts in this
tree" — rustls here runs on aws-lc-rs, so rcgen is what puts ring in: a new package,
not a new edge.

CI: all 10 jobs green on the first run.