fix(deps): bump vulnerable transitive crates

[anoop-narang]

Lockfile-only update of transitive crates with published advisories. All move within the version ranges their dependents already allow.

• zerovec 0.11.6 → 0.11.8, zerovec-derive 0.11.3 → 0.11.6 (GHSA-7fx9-626j-vqph)
• quinn-proto 0.11.16 → 0.11.19
• h2 0.4.15 → 0.4.19 (RUSTSEC-2026-0258)
• rustls 0.23.42 → 0.23.45 (GHSA-2mjx-qc3c-rqvc, RUSTSEC-2026-0285); pulls aws-lc-rs 1.18.1, aws-lc-sys 0.45.0, rustls-webpki 0.103.15

cargo fmt --check, cargo clippy --all-targets -- -D warnings and the unit tests (538) pass locally.
cargo update also re-links dependents onto versions already in the lockfile (no new packages): colored, dirs-sys, errno, quinn-udp, rustix, rustls-platform-verifier, tempfile and winapi-util move from windows-sys 0.61.2 to 0.59.0, and tempfile from getrandom 0.4.3 to 0.3.4. Cargo 1.92, 1.96 and 1.99 all produce this same lockfile, and a no-op cargo update -p h2 --precise 0.4.15 on main re-links the same windows-sys edges, so it is how the resolver settles this graph rather than a toolchain artefact. windows-sys only builds on Windows targets.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!