quick-xml before 0.41 has quadratic run time when checking a start tag for
duplicate attribute names (RUSTSEC-2026-0194) — a DoS risk when parsing a
crafted KDBX document. 0.41.0 fixes the advisory and needs no source changes;
the build (default / save_kdbx4 / serialization+totp) and full test suite pass
on it unchanged.