fix(deps): opensrv-mysql → aws-lc-rs fork on rustls ≥0.23.45 (RUSTSEC-2026-0285)

[luthermonson]

DO NOT MERGE without review — prepared for human review, coordinate ordering with #41.

What

Fixes RUSTSEC-2026-0285 (rustls < 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level; LOW — conformance bug, transcript stays authenticated) in litewire's dependency graph.

The only affected copy is rustls 0.22.4, pulled by opensrv-mysql 0.7.0 (crates.io latest) → tokio-rustls 0.25. There is no fixed opensrv-mysql on crates.io. This PR redirects opensrv-mysql at an ePHPm-org fork of 0.7.0 whose sole change is tokio-rustls 0.25 → 0.26 (rustls ≥ 0.23.45), pinned to the aws-lc-rs provider (never ring).

• Fork: https://github.com/ephpm/opensrv-mysql (rev 42efd44), [patch.crates-io] in Cargo.toml.
• Drops rustls 0.22.4, tokio-rustls 0.25.0, rustls-webpki 0.102.8; bumps the existing rustls 0.23 line to 0.23.45.
• deny.toml: removes the now-unused RUSTSEC-2026-0049 webpki ignore (the 0.102.8 copy is gone; 0098/0099/0104 stay — still matched by the tiberius 0.101.7 dev-dep), and allows the fork git source.

Invariants preserved

• opensrv-mysql tls auth feature (Guard the opensrv-mysql tls feature — default-features = false would expose the CLIENT_SSL no-username path #32): the fork changes only Cargo.toml; src/** (the tls feature, secure_run_with_options, and the init_after_ssl re-parse that makes CLIENT_SSL auth work) is byte-for-byte upstream 0.7.0. The compile-time fence in litewire-mysql/src/lib.rs still holds — verified by cargo check -p litewire-mysql against the fork.
• No ring: the fork pins aws-lc-rs; cargo tree -e no-dev -i ring is empty in the production graph.
• MSRV 1.88: rustls 0.23.45 / tokio-rustls 0.26 / aws-lc-rs 1.18 / rustls-webpki 0.103.15 all declare rust-version = 1.71.

Verified

• cargo deny check advisories sources → advisories ok, sources ok (0285 no longer matches anything).
• cargo check -p litewire-mysql against the fork → clean (fence holds).
• cargo tree confirms rustls 0.23.45, no 0.22.x, no ring.

Coordination

• ci: add Turso Pin Watch — daily bump PR when crates.io is ahead #41 (ci/watch-turso) is red purely from this advisory. Merging this first (or rebasing ci: add Turso Pin Watch — daily bump PR when crates.io is ahead #41 onto it) turns ci: add Turso Pin Watch — daily bump PR when crates.io is ahead #41 green.
• A companion ePHPm PR bumps the litewire rev to this branch and declares the same [patch] in its own root (a patch does not propagate through a git dependency).

Follow-up

Retire the fork/patch when a fixed opensrv-mysql is published to crates.io, or when litewire migrates off opensrv-mysql.

[ephpm]

ePHPm Preview — removed

Preview deployment has been torn down.