supersedes/closes #99, #129, #130, #131 with no duplicate dep

[Psy-Fer]

deps: bump log / env_logger / bstr / noodles, and dedupe noodles-bgzf

Consolidates the four Rust-dependency dependabot bumps into one verified PR, plus the follow-up dependabot's noodles bump needs but doesn't include (deduping noodles-bgzf).

Supersedes / closes #99, #129, #130, #131.

Bumps

Crate	From	To
log	0.4.32	0.4.33	patch
env_logger	0.11.10	0.11.11	patch
bstr	1.12.1	1.13.0	minor
noodles	0.111	0.113	minor (pulls noodles-sam 0.85→0.87, noodles-bam 0.90→0.92, noodles-csi 0.56→0.58)
noodles-bgzf	0.47	0.49	dedupe (see below)

Why the extra noodles-bgzf bump

noodles 0.113 depends on noodles-bgzf 0.49 internally, while our direct dep (the BAM writer's libdeflate BGZF path) was pinned to 0.47 — so bumping noodles alone (dependabot #130) leaves two noodles-bgzf versions in the tree (0.47 + 0.49). Bumping our direct dep to 0.49 dedupes to a single version; the libdeflate feature is intact and BAM output is unchanged.

Validation

• Builds clean; clippy --all-targets 0 warnings; fmt clean.
• 579 tests pass (unit + integration, including the BAM write/read round-trip tests — the main API-break risk for a noodles minor bump).
• Single noodles-bgzf version in the dep tree after the dedupe.