chore(deps): fix dependency-audit failures (pre-existing on develop) #695

What fails

CI security-audit gates are red on develop (independent of any recent PR):
Security Audit (CVE) — rustsec/audit-check against the RustSec advisory DB (Cargo.lock).

Evidence

• Recent develop runs of the Security workflow(s) fail (verified 2026-10-22; e.g. repeated failures across the last runs)
• Fleet CLA-removal PR was merged with these audits consciously accepted by the owner ([DECISION 2026-10-22] Remove CLA fleet-wide from public repos (Apache/MIT/meta) — rollout tracker uteke#1548, evidence comment on that PR) precisely because the failures pre-date the PR and are unrelated to it

Suggested fix

1. Run the audits locally (cargo audit, npm audit/bun audit, trivy fs) and enumerate actual advisories
2. Update the affected dependencies (direct first, then transitive pin bumps)
3. For advisories with no fixed version (unmaintained transitive deps), add an explicit audit-ignore with justification + expiry date instead of leaving the gate permanently red
4. Keep these gates as required checks only if they can realistically pass — a permanently-red required check erases the gate's value

Context

Fleet CLA retirement tracker: codecoradev/uteke#1548 (this debt discovered/isolated during that rollout).