feat: switch to using rumqttc fork to resolve potential security issues

[reubenmiller]

Proposed changes

Switch to using a rumqttc fork (https://github.com/thehouseisonfire/rumqtt). There is a discussion here on the upstream project about the need for a fork, bytebeamio/rumqtt#1029.

Currently below shows the impact of switching to the fork (it may be incomplete):

• rumqttc fork only contains rumqttc (not rumqttd), so we'll also have to fork the upstream rumqtt project to update the rumqttd test dependencies (to avoid having to still have project wide CVE ignore rules)
• Requires upgrading MSRV to 1.89 (from 1.85)
• Some rumqttc interfaces that we use for logging have moved from being public to private making them inaccessible (loss of functionality)

Types of changes

• Bugfix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Improvement (general improvements like code refactoring that doesn't explicitly fix a bug or add any new functionality)
• Documentation Update (if none of the other choices apply)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

Paste Link to the issue

Checklist

• I have read the CONTRIBUTING doc
• I have signed the CLA (in all commits with git commit -s. You can activate automatic signing by running just prepare-dev once)
• I ran just format as mentioned in CODING_GUIDELINES
• I used just check as mentioned in CODING_GUIDELINES
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)

Further comments

[reubenmiller]

This is an unacceptable change! The fork no longer gives us access to the status, so we'll have to access if there is another way to provide the logging.

[reubenmiller]

Switching to the fork requires bumping the MSRV

[reubenmiller]

To address these, we'll probably need to fork the rumqtt (upstream) project, and just update the rumqttd components ourselves...this should be a lower risk/impact since we only use it for tests.

[thehouseisonfire]

Hi @reubenmiller, I saw this linked over at my issue.

Anything you need help with from my end?