deps: audit with mix hex.audit and bump mint to 1.11.0

[rubas-agent]

Builds on #76, which lets CI run on pull requests that the agent opens. Only the commits after it are new here.

Switches the dependency audit from mix deps.audit (mix_audit) to mix hex.audit and bumps mint to 1.11.0.

Before: task security:deps, ci.yml, and security.yml run MIX_ENV=test mix deps.audit. mix_audit 2.1.5 reads only a GitHub advisory mirror and does not see the Hex advisory feed (EEF CNA). mint 1.10.1 has three advisories that it did not report.

Problem

• Advisories that the EEF CNA publishes on Hex do not fail our audit.
• mint 1.10.1 (through req and finch) has one HIGH and two MEDIUM advisories.

After: all three places run MIX_ENV=test mix hex.audit. The mix_audit dependency is gone, with yaml_elixir and yamerl, which only it pulled in. The audit ends with "No retired or security advisory packages found". No waivers.

Advisory	Package	Severity	Fix
EEF-CVE-2026-91043 (GHSA-9x8p-qrf4-jq7g)	mint 1.10.1	HIGH	mint 1.11.0
EEF-CVE-2026-92103 (GHSA-q95c-ccq6-j5j6)	mint 1.10.1	MEDIUM	mint 1.11.0
EEF-CVE-2026-94194 (GHSA-gvrc-75rc-7gj9)	mint 1.10.1	MEDIUM	mint 1.11.0

Details

• mint 1.11.0 needs hpax ~> 1.1, so hpax goes from 1.0.4 to 1.1.0. The mint 1.11.0 changelog says "no breaking changes"; the other entries are stricter HTTP/1 and HTTP/2 parsing. The hpax 1.1.0 changelog adds HPAX.protocol_resize/2 and returns errors instead of raising. cloaked_req does not call Mint or HPAX; only Req's default Finch adapter uses them. No code change.
• Hex 2.5.1 is the first Hex with advisories in mix hex.audit. Both workflows run mix local.hex --force, which installs the newest Hex (2.5.1 today, per builds.hex.pm/installs/hex-1.x.csv).
• The CHANGELOG entry for 0.7.0 that names mix deps.audit is history and stays. The changelog has no Unreleased section.
• Checks run locally: the mix hex.audit prototype of the shared security workflow (stub project with the hexpm lock): clean. MIX_ENV=test mix compile --warnings-as-errors: clean. MIX_ENV=test mix test: 96 passed, 3 excluded.