[junhsss]

Bump every dependency the pinned 1.93 toolchain allows. Each commit is one step and passes fmt, clippy, and tests on its own. Merge with Rebase and merge so the TLS change gets its own changelog line.

• Update all semver-compatible crates. This clears RUSTSEC-2026-0097 (rand) and the quinn-proto advisories from the lockfile.
• Move the RustCrypto crates to digest 0.11 and cipher 0.5 together: aes 0.9, cbc 0.2, aes-gcm 0.11, pbkdf2 0.13, hmac 0.13, sha1 0.11, sha2 0.11. Only profile_porter.rs changes. The yt-dlp cookie vectors still pass.
• Bump rusqlite to 0.41. The bundled SQLite goes from 3.51.3 to 3.54.1, which fixes CVE-2026-11822 and CVE-2026-11824 in FTS5.
• Bump tokio-tungstenite to 0.30. It uses sha1 0.11, so the old digest 0.10 stack is gone.
• Bump reqwest to 0.13.
• Bump dirs to 7 and base64 to 0.23. Neither changes behavior on macOS or Linux.
• Group the RustCrypto crates in Dependabot and drop the old sha1/sha2 ignore.

Behavior change:

• HTTP requests now verify TLS against the OS certificate store (rustls-platform-verifier) and use aws-lc-rs instead of ring. Certificates trusted by the OS, such as corporate CAs, now work. Linux needs a system CA bundle. WebSocket connections still use the bundled webpki roots.

Not bumped:

• parking_lot 0.13 needs Rust 1.95. The toolchain is pinned to 1.93.

Checks:

• cargo fmt, cargo clippy -D warnings, cargo deny check, cargo machete, typos
• 380 tests pass
• No RustSec or GHSA advisory matches the new lockfile
• steel forge --list downloads and unpacks the cookbook
• A wss handshake and an https request run without a crypto provider panic
• cargo build --profile dist links on aarch64-apple-darwin

Supersedes #82, #106, #107, #108, #109.