build(deps): sha2 0.11 in the desktop application, with the hex formatting it breaks

[RobbinBouwmeester]

Supersedes #71, which bumped the dependency on its own and could not compile. This carries Dependabot's commit unchanged and adds the code change it needs.

Why #71 failed

sha2 0.11 moves to digest 0.11 and hybrid-array 0.4, so Digest::finalize() returns hybrid_array::Array rather than the old GenericArray. That type does not implement LowerHex, so every format!("{:x}", ..) over a digest stopped compiling:

error[E0277]: the trait bound `Array<u8, UInt<...>>: LowerHex` is not satisfied
   --> src-tauri/src/thermo.rs:555:31
    |
555 |     let got = format!("{:x}", hasher.finalize());

Four sites, all in the desktop crate: diann.rs 703 and 946, thermo.rs 555, and one in a diann test. The engine is unaffected, it hashes with blake3. Only the desktop app job failed on #71; everything else passed.

The change

All four go through a new components::hex. The output is unchanged, and that is the point: two of these strings are compared against the published SHA-256 checksums of the DIA-NN and ThermoRawFileParser downloads, and one is the name of the library cache directory. A different spelling would reject good downloads and miss every existing cache entry, silently.

A test pins the helper against the canonical SHA-256 vectors for the empty input and "abc", plus zero padding and the empty case, so the spelling cannot drift again.

Checks

cargo fmt, cargo clippy --all-targets -- -D warnings and cargo test --lib (83, one new) all clean against sha2 0.11.

Close #71 when this merges.

🤖 Generated with Claude Code