Update Rustls for RUSTSEC-2026-0285

[AnthonyRonning]

RUSTSEC-2026-0285, published September 14, flags the Rustls versions already locked on master. Update Research, Agent, SDK, proxy, and OpenSecret to Rustls 0.23.45, which fixes TLS 1.3 handshake encryption-level validation. Upstream advisory.

The patch changes only five Cargo.lock files. Research and OpenSecret also receive the required AWS-LC and WebPKI updates; OpenSecret needs the new minimum pkg-config version. Existing SDK versions and registry/path sources, TLS features, application protocol code, migrations, and PCR approval files are unchanged. This fix can merge independently before Transport V2 PR #873 is rebased.

Validation completed locally:

• All four existing RustSec/advisory and malicious-crate policies pass with the same cargo-deny 0.20.2 used by CI and the current advisory database.
• SDK: 85 tests passed; proxy: 27 tests passed. Both strict pinned formatting, Clippy, and documentation checks pass; proxy dependency checks pass.
• Research: 818 frontend tests and 415 native tests passed (2 ignored); formatting/lint/typecheck, PR web build, and native formatting/strict Clippy pass.
• Agent: 727 workspace and 30 headless tests passed (3 existing ignores); all four strict Clippy configurations, formatting, and warning-denied builds pass.
• Backend: 636 tests passed, 23 ignored; pinned formatting, strict Clippy, and current-host Nix checks pass.
• Independent review confirmed minimal dependency changes, compatible bounds/MSRVs, and matching downloaded-registry checksums.

All local gates are complete. All 36 applicable hosted checks passed on commit dcca40e, including all four security scans, platform builds, and SDK/backend integration. The two EIF/PCR approval checks were skipped by their normal workflow conditions.

Deploying the backend fix later requires the normal rebuilt EIF, reviewed/signed PCR approvals, and deployment process. This ordinary dependency PR does not alter approvals or perform a deployment. Client rebuilds can ship their dependency update independently.