Bump webpki-roots and webpki-root-certs for the emSign advisories #4875

Background

cargo deny now fails on three advisories about distrusted emSign intermediates whose private keys are public, which breaks the Extra CI checks job on every PR (e.g. #4869):

error[vulnerability]: Bundled root certificates allow trust in distrusted emSign intermediates
    ├ ID: RUSTSEC-2026-0381
error[vulnerability]: Certificate verification may accept distrusted intermediates
    ├ ID: RUSTSEC-2026-0382
error[vulnerability]: Bundled root certificates allow trust in distrusted emSign intermediates
    ├ ID: RUSTSEC-2026-0383

webpki-roots and webpki-root-certs 1.0.10 drop emSign ECC Root CA - G3, which fixes 0381 and 0383. The fixed rustls-webpki (0.103.16) requires aws-lc-rs ^1.18, which the =1.16.2 pin tracked in #4423 blocks. 0383 also still flags webpki-root-certs 0.26.11 from jsonrpsee's rustls-platform-verifier 0.5, though that version only re-exports the 1.x roots.

Acceptance Criteria

• Cargo.lock resolves webpki-roots and webpki-root-certs to >= 1.0.10.
• deny.toml ignores RUSTSEC-2026-0382 under TODO(#4423) and RUSTSEC-2026-0383 for the 0.26.11 copy, each with its rationale.