ci: GitHub Actions hygeine and MSRV 1.88

[notpeter]

• Explicitly specify permissions for all GitHub Actions workflows
• Update Swatinem/rust-cache to v2.9.2 from v2.9.1
• Update actions/checkout to v7.0.1 (add comment with version)
• Add comment for actions/setup-node (# v7.0.0)
• Remove dtolnay/rust-toolchain dependency (rustup is in base runner)
• Switch from using rustup default to using explicit RUSTUP_TOOLCHAIN,
  as the former is overridden by the existence of a rust-toolchain.toml
• Add CARGO_INCREMENTAL=0 to match the previous behavior provided by dtolnay/rust-toolchain.
• Run trybuild as a dedicated ubuntu job, rather than as part of the matrix because rustc output differs between (stable, msrv).
  I think it's ok to not run this on every platform as the rustc output should be (has been) identical between platforms and if not, it's a rustc bug not a dropshot issue.
• Update MSRV to 1.88 (from 1.85)
• Tweak job names so they won't change when MSRV changes (allows stable repo config). E.g.
  Before: build-and-test (macos-14, all, 1.85)
  After: build-and-test (macos-14, all, msrv)
  Unchanged: build-and-test (macos-14, all, stable)

Note

Until this change we were not actually testing under our specified MSRV (1.85)
Which meant we didn't realize that our MSRV was actually 1.88.

See example run output

[notpeter]

error: rustc 1.85.1 is not supported by the following packages:
  rcgen@0.14.9 requires rustc 1.88
  subprocess@1.2.1 requires rustc 1.88
  time@0.3.47 requires rustc 1.88.0
  time-core@0.1.8 requires rustc 1.88.0
  time-macros@0.2.27 requires rustc 1.88.0
  trybuild@1.0.120 requires rustc 1.88

Looks in main our actual MSRV is 1.88.0 (2025-06-26).
Not only do the dependencies require it, but since #1659 the dropshot codebase does too (let chains):

dropshot/dropshot_endpoint/src/api_trait.rs

Line 234 in 9bd5107

if let TraitItemPartParsed::Other(other) = item

To support 1.85, in addition to rolling back time and rcgen and undo that let chain, we would have to refactor our use of subprocess::Job introduced in #1546 and stay stuck on a 3.5year old subprocess crate.

subprocess = "=0.2.9" # (2022-05-15) 0.2.10+  requires Rust 1.88
trybuild = "=1.0.119" # (2026-08-02) 1.0.120+ requires Rust 1.88
rcgen = "=0.14.7"     # (2026-01-19) 0.14.8+  requires Rust 1.88

So I've gone ahead and explicitly bumped MSRV to 1.88 (from 1.85).

[notpeter]

This requires adjusting the required test passage configuration in the GitHub repo settings.

Remove:

build-and-test (macos-14, all, 1.85)
build-and-test (macos-14, default, 1.85)
build-and-test (ubuntu-22.04, all, 1.85)
build-and-test (ubuntu-22.04, default, 1.85)
build-and-test (windows-2022, all, 1.85)
build-and-test (windows-2022, default, 1.85)

Add:

build-and-test (macos-14, all, msrv)
build-and-test (macos-14, default, msrv)
build-and-test (ubuntu-22.04, all, msrv)
build-and-test (ubuntu-22.04, default, msrv)
build-and-test (windows-2022, all, msrv)
build-and-test (windows-2022, default, msrv)
trybuild

[notpeter]

Largely superseded by:

• raise the MSRV to 1.88 #1694
• run trybuild tests in their own CI job #1695

@sunshowers: Your PRs came a few hours after I opened this one. Great minds think alike. :D I wonder whether your agent found my branch or we just did near identical work in parallel.

Remaining changes have been moved to a clean PR:

• ci: GitHub Actions workflow improvements #1697