fix: update bytes to resolve CVE-2026-25541

[dannyneira]

Summary

• Updates bytes from 1.5.0 to 1.11.1 in Cargo.lock to resolve CVE-2026-25541 / GHSA-434x-w66g-qw3r.
• Updates wasm-bindgen/wasm-bindgen-futures lockfile entries to non-yanked compatible versions so the full workspace builds with the current Rust toolchain.

Vulnerability details

• Advisory: GHSA-434x-w66g-qw3r
• Dependabot alert: https://github.com/warpdotdev/graphql-ws-client/security/dependabot/8
• Package: bytes
• Ecosystem: Rust / Cargo
• Relationship: transitive runtime dependency
• Vulnerable range: >= 1.2.1, < 1.11.1
• Patched version: 1.11.1

Verification

• cargo audit --json no longer reports bytes / RUSTSEC-2026-0007.
• Remaining audit findings are unrelated existing alerts: h2, idna, and mio.
• cargo build --workspace
• cargo test --workspace

Conversation: https://staging.warp.dev/conversation/b576f923-ea57-43aa-958b-6322a653afd1
Run: https://oz.staging.warp.dev/runs/019e3184-22a8-73c1-944b-68ed36128c9b
This PR was generated with Oz.