chore(deps): refresh manifests + lockfile, fold in criterion/rustls-pemfile/paste migrations

[FlorentinDUBOIS]

Summary

Refreshes sozu's workspace dependency declarations and lockfile to match crates.io latest, folds in three low-risk migrations, and closes four security/maintenance advisories in one PR.

Closes

• GHSA-xp3w-r5p5-63rr / CVE-2026-42327 (HIGH) — openssl X509Ref::ocsp_responders UB on non-UTF-8 OCSP URLs. Auto-closes Dependabot alert Implement Forwarded header parsing and writing according to specification #46 on merge.
• GHSA-xv59-967r-8726 / CVE-2026-44662 (MEDIUM) — openssl heap overflow on AES key-wrap-with-padding. Auto-closes Dependabot alert Group dumped configuration in one message #47 on merge.
• RUSTSEC-2024-0436 — paste unmaintained → replaced with pastey (drop-in fork).
• RUSTSEC-2025-0134 — rustls-pemfile unmaintained → migrated to rustls_pki_types::PrivateKeyDer::from_pem_slice (already in our tree transitively via rustls).

Neither openssl-affected API is reached by sozu's build: no X509Ref::ocsp_responders use anywhere; rustls-openssl 0.3.x wires only aes_{128,256}_gcm / chacha20_poly1305 — no AES key-wrap-with-padding. The openssl bump is a hygiene fix (see lib/src/crypto.rs:84-98 / :104-115). After merge, cargo audit returns clean (zero warnings).

What changes

Manifests (5 files, 11 edits)

• Cargo.toml — 7 floor tightens (flate2 ^1.1 → ^1.1.9, libc 0.2.185 → 0.2.186, nix 0.31.2 → 0.31.3, criterion 0.5.1 → 0.8.2, rustls-openssl 0.3.0 → 0.3.1, rustls 0.23.38 → 0.23.40, tokio 1.52.1 → 1.52.3) + 1 line removal (rustls-pemfile).
• lib/Cargo.toml — drop rustls-pemfile workspace inheritor.
• e2e/Cargo.toml — paste = "1.0" → pastey = "^0.2.3".
• fuzz/Cargo.toml — libfuzzer-sys "0.4" → "^0.4.12".
• Cargo.lock + fuzz/Cargo.lock — refreshed via cargo update (32 transitive movers + 2 added version slots itertools 0.13.0, wit-bindgen 0.57.1, plus criterion 0.8 dep fan-out).

40 of 53 workspace deps were already at the latest crates.io patch — no edit needed.

Source migrations (5 files)

• lib/benches/header_formatting.rs:9 — criterion::black_box → std::hint::black_box (38 call sites are signature-compatible; only the import changes).
• lib/src/tls.rs:160-170 — rustls_pemfile::read_one + Pkcs1Key/Pkcs8Key/Sec1Key match → single PrivateKeyDer::from_pem_slice call. Byte-for-byte parse equivalent.
• lib/src/crypto.rs:407-413 — same migration.
• lib/benches/crypto_provider.rs:38-54 — same migration (third pemfile call site).
• e2e/src/tests/protocol_pair_matrix.rs:105 — paste::paste! → pastey::paste! (drop-in macro).

CHANGELOG.md — ### 🔐 Security + ### 🔄 Changed sub-blocks under [Unreleased].

Deferred (separate PR)

• chore/nom-8-migration — nom 7 → 8. Parser API rewrite across ~2,888 LOC including the security-sensitive H2 frame parser at lib/src/protocol/mux/parser.rs. Medium-high risk; deserves its own fuzz + e2e validation cycle.

MSRV

Unchanged at 1.88.0. All movers declare MSRV ≤ 1.88; highest mover MSRV is wasip2 1.0.3 at 1.87.

Test plan

Locally validated on chore/deps-refresh:

• cargo build --locked (defaults baseline)
• cargo build --locked --no-default-features --features crypto-ring,opentelemetry,splice,simd
• cargo build --locked --no-default-features --features crypto-aws-lc-rs,opentelemetry,splice,simd
• cargo build --locked --no-default-features --features crypto-openssl,opentelemetry,splice,simd
• cargo build --locked --no-default-features --features fips,opentelemetry,splice,simd
• cargo clippy --all-targets --locked --no-default-features --features crypto-openssl,opentelemetry,splice,simd -- -D warnings
• cargo test -p sozu-lib … — 559 tests passed, 0 failed
• cargo test -p sozu-e2e … -- --skip tests::fuzz_tests:: — 362 tests passed, 0 failed, 1 ignored (the known test_tls_1_2_ecdsa_openssl_regression_probe, pre-existing, unrelated)
• cargo bench --package sozu-lib --no-run — exercises criterion 0.8 + the third pemfile site at crypto_provider.rs
• cargo +nightly fmt --all -- --check — clean
• cargo audit — zero warnings (both RUSTSEC entries cleared)
• (cd fuzz && cargo +nightly fuzz build) — skipped locally (dev box missing gcc-c++; libfuzzer-sys 0.4.12 is a manifest tighten only — CI has the C++ toolchain and will validate the link step)

Refs

• https://github.com/sozu-proxy/sozu/security/dependabot/46
• https://github.com/sozu-proxy/sozu/security/dependabot/47
• https://rustsec.org/advisories/RUSTSEC-2024-0436
• https://rustsec.org/advisories/RUSTSEC-2025-0134