build(deps): bump Rust and Python deps to clear CI security gates

[katriendg]

Summary

Consolidates pending Rust and Python dependency security updates into a single PR to unblock CI. Every open PR currently fails the same two required checks (Cargo Audit and Security Scan / Grype) due to transitive dependency vulnerabilities. This PR resolves both blockers.

Supersedes: #413, #425, #430, #431, #432, #434, #435, #436, #437, #438, #439, #440, #441, #442, #443

Root Causes & Fixes

CI Gate	Root Cause	Fix
Cargo Audit (Rust)	New RUSTSEC advisories for rand, openssl, and rustls-webpki in transitive deps	cargo update across all 14 Rust workspaces bumps to patched versions
Security Scan (Grype)	HIGH+ vulns in openssl (0.10.73/74/76), rand (0.8.5/0.9.2), rustls-webpki, and lxml (5.3.0)	Rust lockfile updates clear crate findings; lxml pinned to 6.1.0

Changes

Rust Cargo.lock updates (14 files, lockfiles only — no Cargo.toml changes)

• rand 0.8.5 → 0.8.6, 0.9.2 → 0.9.4, 0.10.0 → 0.10.1 (clears GHSA-cq8v-f236-94qc)
• openssl 0.10.73 / 0.10.74 / 0.10.76 → 0.10.78 (clears CVE-2025-3416, CVE-2024-12797)
• rustls-webpki 0.103.10 → 0.103.13 (clears GHSA-965h-392x-2mh5, GHSA-xgp8-3hg3-c2mh)
• Additional transitive bumps from cargo update

Python dependency update (1 service)

• src/500-application/510-onvif-connector/services/onvif-camera-simulator/ — lxml 5.3.0 → 6.1.0 in requirements.in (clears GHSA-vfmq-68hx-4jfw); requirements.txt regenerated with uv pip compile --generate-hashes

Verification

• cargo audit --deny warnings passes on all 14 Rust crates with .github/audit.toml config
• grype dir:. --config .grype.yaml returns exit 0 in a clean checkout (only Medium-severity uuid npm finding remains, below fail-on-severity: high threshold)
• govulncheck ./... passes on both Go modules (unchanged from main — no Go-related changes in this PR)
• No Cargo.toml, Go module, source code, or behavioral changes

Known Residuals (already suppressed)

• rand 0.8.6 still appears in Grype scans (advisory fixed-in is 0.9.3). Suppressed in .github/audit.toml via RUSTSEC-2026-0097. Blocked on upstream azure_iot_operations_mqtt releasing without rand 0.8.x.
• rustls-webpki 0.102.8 (transitive via AIO SDK's rumqttc fork) suppressed in .grype.yaml via GHSA-pwjx-qhcg-rvj4.

Impact on Other PRs

Once merged, Dependabot will auto-close the 15 superseded PRs when it detects the fixes on main. The remaining open PRs (#411, #422, #401, #427, #428, #429, #433) will have their two universal CI blockers resolved and can proceed through review.

🔒 - Generated by Copilot

[katriendg]

Note our current CI is failing on ORT CDN, seems other users are facing it as well, which we expect to be transient