chore(deps): bump noodles 0.113 -> 0.115, noodles-bgzf 0.49 -> 0.51 - #211

Closes #207.

Dependency bump only, no source change.

Lockfile also moves noodles-bam 0.92 → 0.94, noodles-sam 0.87 → 0.89, noodles-csi 0.58 → 0.60
as transitive consequences.

Why now

The two noodles-bgzf releases are about thread-pool ownership, which touches this project
directly because alignment runs on rayon:

• 0.50 — multithreaded readers and writers use exclusive local thread pools instead of rayon's
  default global pool, and the previously deprecated with_worker_count methods are supported
  again as the way to size them.
• 0.51 — the worker count is synced to the number of managed buffers rather than taken from
  rayon's global pool, so constructing one no longer initialises that pool as a side effect.

Today src/io/bam.rs only builds single-threaded bgzf::io::Writers, so nothing in this PR
depends on that behaviour. It matters for the follow-up question of whether the BAM writer should
become multithreaded, which is tracked separately in #207 and deliberately not done here.

What was verified

Everything below was run on this branch as submitted.

• cargo fmt --check — clean

• cargo clippy --all-targets -- -D warnings — clean

• cargo test — 593 tests pass, 0 failures (565 unit + 23 + 4 + 1 across the integration binaries)

• BAM bytes unchanged. Built the branch, then rebuilt with only Cargo.toml/Cargo.lock
  reverted to origin/main, and ran the identical command against the identical index and output
  prefix:

  ./target/debug/rustar-aligner --runMode genomeGenerate \
      --genomeDir /tmp/ab/idx --genomeFastaFiles test/simple.fa --genomeSAindexNbases 4
  ./target/debug/rustar-aligner --genomeDir /tmp/ab/idx --readFilesIn test/reads.fq \
      --outFileNamePrefix /tmp/ab/run/ --outSAMtype BAM SortedByCoordinate
  shasum -a 256 /tmp/ab/run/Aligned.sortedByCoord.out.bam

  Same digest 207b17d3… on both. The Genome and SA index files are likewise identical
  (4b09e0e7… / c398a82e…).

  Note on scope: this uses the bundled test/simple.fa + test/reads.fq micro-fixture, so it
  proves the BGZF/BAM encoding path is unchanged, not that every code path in noodles is. The
  --outFileNamePrefix has to match between the two runs, because the @PG CL: header line
  records the command line and will otherwise differ on its own.

What was not done

No move to the multithreaded BGZF writer, no with_worker_count plumbing, no behaviour change of
any kind. One theme per PR; the writer question stays in #207.