Rust dependencies carry three advisories that CI does not report #738

What goes wrong

The desktop shell's Cargo.lock resolves three crate versions with published advisories. CI does not report them, because its trivy scan only fails on HIGH and CRITICAL findings it can match, and none of these surfaced there. cargo audit (RustSec) reports all three.

The rustls advisory is the one that reaches users: TLS 1.3 handshake messages accepted across encryption level boundaries, on the connections the desktop app makes. The quick-xml ones are denial-of-service bugs in XML parsing, and here quick-xml only parses StemDeck's own plist and config files.

cargo audit also reports 6 unmaintained, 2 unsound and 1 yanked crate, all as warnings.

Constraints

• rustls should move with cargo update -p rustls, but quick-xml 0.41 is a semver-incompatible bump that has to come through a plist / Tauri release.
• Updating Cargo.lock does not touch uv.lock, so the in-app update path is unaffected.