security(deps): bump rustls-webpki 0.103.12→0.103.13 (GHSA-82j2-j2ch-gfr8, HIGH)

[hyperpolymath]

What

Bumps rustls-webpki 0.103.12 → 0.103.13 (lockfile-only; transitive via rustls).

Why

Resolves the rustls-webpki CRL BIT STRING DoS — index-out-of-bounds panic via BorrowedCertRevocationList::from_der().

• GHSA-82j2-j2ch-gfr8 == RUSTSEC-2026-0104 (same advisory, two registries)
• CVSS 7.5 HIGH, CWE-125; vulnerable < 0.103.13, fixed 0.103.13

Resolves

• Dependabot alert fix(ci): bump erlef/setup-beam SHA for ubuntu24 runner support #4
• Issue security: 2 CVE advisories in Cargo.lock (bridge triage, Track E) #16 — the "2 findings" there (GHSA-82j2-j2ch-gfr8 + RUSTSEC-2026-0104) are this one advisory; the issue's "remove unused dependency" note is incorrect (rustls-webpki is transitive, not removable — only bumpable).

Notes

• Dependabot did not auto-PR this because it is a transitive/lockfile-only dep (manifest = Cargo.lock); part of a P0 estate-wide remediation of this advisory.
• Commit signed (ssh, id_ed25519_signing). Branch cut from fresh origin/main.
• Security PR → manual review. Do not auto-merge.

🤖 Generated with Claude Code

Closes #16