transitive dependency on `time` with CVE

[blakehawkins]

time-rs/time#293

https://github.com/utkarshkukreti/select.rs/blob/master/Cargo.toml#L14

https://github.com/servo/html5ever/blob/master/xml5ever/Cargo.toml

It appears that bumping the html5ever dependency would resolve it, but I haven't checked myself