fix(security): patch rustls TLS handshake validation

[benfavre]

ShellDeck locked rustls 0.23.41, affected by RUSTSEC-2026-0285. Update the lockfile to patched rustls 0.23.45 and its required rustls-webpki 0.103.15 dependency. The pinned nightly and pathfinder_simd 0.5.5 remain unchanged; no advisory exemptions were added.

Refs #175.

Validation:

• cargo audit and cargo deny check advisories bans licenses sources pass with the existing reviewed advisory baseline.
• Locked shelldeck-core and shelldeck-update tests pass: 416 tests, with five existing opt-in tests ignored.
• cargo fmt and git diff --check pass.

Release publication is still required to protect installed clients.