Upgrade libp2p (0.56) to clear transitive RUSTSEC advisories in deny.toml ignore-list

[chefsale]

Context

deny.toml currently carries a dated baseline of accepted security advisories (added in #3091, cargo deny check advisories now gates CI). Every ignored advisory is a transitive dependency that can't be lock-bumped without upgrading upstream crates — predominantly libp2p 0.56's TLS/QUIC/DNS stack. GitHub Dependabot reports these as ~12 high-severity alerts on the default branch.

Advisories to clear

Pending a libp2p upgrade (via libp2p-tls / libp2p-quic / libp2p-dns):

RUSTSEC	Crate	Notes
RUSTSEC-2026-0044	aws-lc-sys	via libp2p-tls; needs >=0.39 (breaking)
RUSTSEC-2026-0048	aws-lc-sys	via libp2p-tls
RUSTSEC-2026-0049	rustls-webpki	via libp2p-tls (old 0.101.x line)
RUSTSEC-2026-0098	rustls-webpki	via libp2p-tls
RUSTSEC-2026-0099	rustls-webpki	via libp2p-tls
RUSTSEC-2026-0104	rustls-webpki	via libp2p-tls
RUSTSEC-2026-0118	hickory-proto	via libp2p-dns; NSEC3 unbounded loop, no upstream fix yet
RUSTSEC-2026-0119	hickory-proto	via libp2p-dns; needs >=0.26.1 (breaking)
RUSTSEC-2026-0097	rand	transitive 0.8.5 (no 0.8 fix)

Separately tracked (no dependency path to libp2p, no upstream fix):

• RUSTSEC-2023-0071 — rsa Marvin timing attack; no patched release exists. Revisit if/when upstream ships a fix, or if the crate can be dropped.

Definition of done

• Bump libp2p to a release whose TLS/QUIC/DNS deps resolve aws-lc-sys >=0.39, rustls-webpki >=0.103.13, hickory-proto >=0.26.1.
• Remove each cleared entry from the [advisories].ignore list in deny.toml.
• cargo deny check advisories bans licenses sources stays green.
• Full build + test pass (libp2p majors tend to have API churn).

References

• Advisory gate + baseline: ci: enable advisory/CVE scanning and clear the lock-fixable advisories #3091
• Hardening follow-up: ci: supply-chain & image hardening (action pins, image digests, checksums, secret handling) #3104