chore(security): weekly cargo-vet import refresh

[github-actions]

Summary

Weekly refresh of supply-chain/imports.lock from upstream
audit sources (Mozilla, Google, Bytecode Alliance, ISRG,
Zcash). Opened automatically by
.github/workflows/cargo-vet-refresh.yml.

⚠️ Before merging

GitHub suppresses CI runs on PRs opened by the
default GITHUB_TOKEN (anti-recursion safety). To
trigger the Tier 1 checks:

• close and reopen this PR, or
• push an empty commit:

  git fetch origin chore/cargo-vet-refresh
  git checkout chore/cargo-vet-refresh
  git commit --allow-empty -S -m "chore: trigger ci"
  git push

What changed

Diff is entirely within supply-chain/ — either added
audit records or pruned exemptions that are now covered
by upstream audits.

Why review is still needed

Even though the content comes from trusted upstreams,
the merge commit itself must be signed + reviewed per
branch protection. Skim the diff for anything
unusual (e.g. a removed audit record that's been
replaced by an exemption — would indicate an upstream
has retracted an audit, which warrants investigation).

[githubrobbi]

Superseded by #624 (v0.6.41).

That release ran cargo vet regenerate imports + cargo vet prune against the current upstream sources, which produced the same two exemption removals this PR carries (shlex, simdutf8) plus newer audits that additionally covered clap, clap_builder, clap_derive and toml for the dependency bumps in the same release. Total exemptions went from 273 to 167.

Closing rather than merging so the refresh lands in one CI pass instead of two.