chore: update phf to 0.13

[eatradish]

Update phf and phf-codegen to 0.13

[pamburus]

Security advisory: please merge this PR

This PR is now blocking a security fix in downstream crates.

The unmerged upgrade from phf 0.11 → phf 0.13 means that terminfo 0.9.0 still pulls in phf_generator 0.11.3, which depends on rand 0.8.6. That version of rand is affected by an unsoundness advisory (affected versions: >= 0.7.0, < 0.9.3; patched in 0.9.3):

Safe code using the public API can cause Undefined Behaviour when the log and thread_rng features are enabled, a custom logger accesses rand::rng() / rand::thread_rng() and calls TryRng / RngCore methods on ThreadRng. This creates aliased mutable references, which is detectable by Miri.

The full dependency chain that exposes downstream projects to this advisory is:

terminfo 0.9.0
└─ (build) phf_codegen 0.11.3
   └─ phf_generator 0.11.3
      └─ rand 0.8.6 ⚠️ vulnerable (>= 0.7.0, < 0.9.3)