Bump `rustls`/`rustls-webpki`

[luisschwab]

New vulnerabilities on the block: RUSTSEC-2026-0098/RUSTSEC-2026-0099

Crate:     rustls-webpki
Version:   0.101.7
error: 2 vulnerabilities found!
Title:     Name constraints for URI names were incorrectly accepted
Date:      2026-04-14
ID:        RUSTSEC-2026-0098
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0098
Solution:  Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6
Dependency tree:
rustls-webpki 0.101.7
├── rustls 0.21.12
│   └── bitreq 0.3.4
│       └── halfin 0.2.0
└── bitreq 0.3.4

Crate:     rustls-webpki
Version:   0.101.7
Title:     Name constraints were accepted for certificates asserting a wildcard name
Date:      2026-04-14
ID:        RUSTSEC-2026-0099
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0099
Solution:  Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6

Error: Process completed with exit code 1.

[luisschwab]

cc @satsfy

[tnull]

Likely not super important for our use, but better safe than sorry.

On a more general note it might also make sense to add a cargo-audit CI job, at least for the bitreq part. @tcharding WDYT?

[luisschwab]

All my CIs are red because of this

[tnull]

All my CIs are red because of this

I was referring to the actually fixed vulnerability. But yes, we should still bump the dependency ofc.

[tcharding]

On a more general note it might also make sense to add a cargo-audit CI job, at least for the bitreq part. @tcharding WDYT?

I have no real opinion of carog-audit but I don't see a reason not to. I'd definitely exclude verify/ and integration_test/ though if its going to be noisy (probably node too).