fix(deps): bump 10 HIGH CVEs in codex-rs (aws-lc-sys, quinn-proto, rustls-webpki)

Cascades the heliosCLI PR #233 CVE pattern to codex-rs. Closes 10 of
11 HIGH advisories surfaced by `cargo audit`:

- aws-lc-sys 0.37.0 -> 0.40.0
  Closes RUSTSEC-2026-0044, 2026-0045, 2026-0046, 2026-0047, 2026-0048
- quinn-proto 0.11.13 -> 0.11.14
  Closes RUSTSEC-2026-0037
- rustls-webpki 0.103.9 -> 0.103.13
  Closes RUSTSEC-2026-0049, 2026-0098, 2026-0099, 2026-0104

Lock-file updates only (workspace declarations unchanged).

The 11th advisory, RUSTSEC-2023-0071 (Marvin attack on rsa crate),
has no upstream fix. The rsa maintainers have not shipped a patched
version. The crate enters our graph transitively through sqlx's
native-tls / mysql backends that are not exercised in production
code paths. Suppressed in `codex-rs/.cargo/audit.toml` with an
explanatory comment and re-evaluation pointer.

Verification: `cargo audit` reports 0 vulnerabilities, 5 informational
warnings (unmaintained/unsound — not the rsa CVE, suppressed in
audit.toml as expected).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: KooshaPari

codex-rs/.cargo/audit.toml

@@ -3,4 +3,11 @@ ignore = [
     "RUSTSEC-2024-0388", # derivative 2.2.0 via starlark; upstream crate is unmaintained
     "RUSTSEC-2025-0057", # fxhash 0.2.1 via starlark_map; upstream crate is unmaintained
     "RUSTSEC-2024-0436", # paste 1.0.15 via starlark/ratatui; upstream crate is unmaintained
+    # RUSTSEC-2023-0071: Marvin attack on rsa crate (RSA decryption timing
+    # side-channel). No upstream fix has been released — the rsa maintainers
+    # have not yet shipped a patched version. The crate enters our graph
+    # transitively through sqlx's native-tls / mysql backends, which are
+    # not exercised in production code paths. Re-evaluate when rsa publishes
+    # a fix; track upstream at https://rustsec.org/advisories/RUSTSEC-2023-0071
+    "RUSTSEC-2023-0071",
 ]