chore(deps): upgrade vulnerable dependencies via cargo audit

[larryl3u]

Summary

Bumps Rust toolchain to 1.95.0 and upgrades a batch of dependencies flagged by cargo audit. Vulnerability count: 36 → 22 (everything left requires major API rewrites or has no patched version).

Direct dep bumps

• bytes 1.4 → 1.11.1
• diesel 2.2 → 2.2.3 (resolves 2.3.x via SDK)
• diesel-async git → 0.7.4 (crates.io — the blocker noted in the inline comment has released)
• diesel_migrations 2.1 → 2.3.1
• git2 0.16 → 0.19
• shadow-rs 0.16 → 0.35
• tar 0.4.40 → 0.4.45
• tracing-subscriber 0.3.17 → 0.3.20
• aptos-indexer-processor-sdk → tag aptos-indexer-processor-sdk-v2.2.1 (matches what processors-v2 pulls in — same commit via tag= instead of rev= so Cargo dedupes it into a single crate instance)
• processor (aptos-indexer-processors-v2) → 03b756b (the revision that fixes futures compatibility with aptos-core)

Transitive updates (via cargo update -p)

lz4_flex, quinn-proto, ring 0.17, rustls 0.21.x, rustls-webpki 0.102.x, time.

New [patch.crates-io] entry

Added a jemalloc-sys shim entry that mirrors the same workaround used upstream — required because the newer aptos-indexer-processor-sdk transitively pulls in another aptos-core rev whose aptos-profiler links to tikv-jemalloc-sys, conflicting with our local aptos-profiler's jemalloc-sys.

Code adjustments required by the SDK / processors-v2 upgrade

• Removed the EventsProcessor variant usage from crates/aptos-localnet/src/processors.rs, crates/aptos/src/node/local_testnet/processors.rs, and aptos-move/aptos-workspace-server/src/services/processors.rs — it was removed from the processor crate in PR feat!(indexer-grpc-utils): Cut out cloud-storage dependency from indexer-grpc #141 (Deprecate v1 tables and processors).
• Updated TransactionStreamConfig call sites to the new shape: auth_token is now Option<String>, the retry-related fields collapsed into a single reconnection_config: ReconnectionConfig, and a new backup_endpoints field was added.

What's left / known follow-ups

• docker/builder/docker-bake-rust-all.hcl still pins rust:1.80.1-bullseye@sha256:.... This needs the 1.95.0 image hash — run docker buildx imagetools inspect rust:1.95.0-bullseye and update in a follow-up.
• Remaining 22 advisories: ed25519-dalek 1→2, curve25519-dalek 3→4, ring 0.16→0.17, protobuf 2→3, rustls-webpki 0.100/0.101 (via older transitive google-cloud-* / tungstenite), tracing-subscriber 0.2 (via ark-relations), and rsa (no patch available upstream).

Test plan

• cargo check --workspace passes locally (confirmed on this branch)
• cargo audit count drops from 36 → 22
• CI green
• Smoke test the localnet processors path that lost EventsProcessor

[areshand]

Unfortunately, the CI/CD is still not working now. let's manual check the tests cargo nextest run --profile ci to see if anything is broken due the version upgrade