fix(deps): bump crates for disclosed RUSTSEC advisories

[Svector-anu]

Automated dependency bump to address disclosed RustSec advisories found by osv-scanner.

• CVE / Advisory: RUSTSEC-2026-0258 (GHSA-q83h-524g-xf6h) — h2 unbounded empty DATA frames (low; DoS)
• Package: h2 0.4.14 → 0.4.16
• Advisory: RUSTSEC-2026-0186 — memmap2 unchecked pointer offset
• Package: memmap2 0.9.10 → 0.9.11
• Advisory: RUSTSEC-2026-0221 — event-listener !Send tag soundness
• Package: event-listener 5.4.1 → 5.4.2
• Advisory: RUSTSEC-2026-0204 — crossbeam-epoch invalid pointer dereference in fmt::Pointer
• Package: crossbeam-epoch 0.9.18 → 0.9.20

Severity

Low–moderate DoS / soundness issues in transitive deps (h2 via zed-reqwest/hyper for GUI HTTP; memmap2 via fontdb; event-listener also on the CLI/HID++ path; crossbeam-epoch via rayon/ignore). No application code changes.

Verification

• Reproduced locally: yes
• Command: osv-scanner scan source --recursive --no-ignore --format=json . then cargo update -p h2 --precise 0.4.16 (and the three sibling precise bumps)
• Before: lockfile pinned the vulnerable versions above
• After: lockfile pins the patched versions; cargo metadata resolves cleanly
• Environment: osv-scanner 2.5.1, cargo/rustc on linux amd64

Detected by osv-scanner. No code changes outside the lockfile.

Note: quick-xml@0.30.0 (RUSTSEC-2026-0194 / 0195) remains via xcb ← zed-scap and cannot be bumped without an upstream xcb/scap change. Unmaintained notices (bincode, paste, instant, …) left alone — bincode is already documented in .cargo/deny.toml.