fix: update serde_with to patched 3.23 release

[ahu04]

The serde_with = "~3.11" constraint prevents downstream projects from resolving a version patched for GHSA-7gcf-g7xr-8hxj. Relax it to 3 so downstream users can choose compatible minor and patch releases, and regenerate the workspace lockfile with patched serde_with 3.23.0.

The locked serde_with release requires Rust 1.88. Update the library and benchmark-harness MSRV, README, and CI matrix accordingly. Convert two nested conditions to equivalent let chains required by Clippy at the new MSRV; parser behavior is unchanged.

[codecov]

Codecov Report

❌ Patch coverage is 83.33333% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 81.34%. Comparing base (7ab1334) to head (b2e7e4f).

Files with missing lines	Patch %	Lines
src/sentences/faa_mode.rs	66.66%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #170   +/-   ##
=======================================
  Coverage   81.34%   81.34%           
=======================================
  Files          39       39           
  Lines        1576     1576           
=======================================
  Hits         1282     1282           
  Misses        294      294           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[CramBL]

Thanks! This is a great change, but I have 2 requests:

1. Change the version bound from ~3.23 to 3 since there's no reason to not allow newer minor/patch releases, users can choose themselves.
2. Include more context in the commit message (mention the vulnerability, and now, the change to the version bounds). The commit message is much more important than the PR body and currently the PR body is very useful while the commit message is very generic

[ahu04]

Thanks! This is a great change, but I have 2 requests:

1. Change the version bound from ~3.23 to 3 since there's no reason to not allow newer minor/patch releases, users can choose themselves.
2. Include more context in the commit message (mention the vulnerability, and now, the change to the version bounds). The commit message is much more important than the PR body and currently the PR body is very useful while the commit message is very generic

Thanks, fixed both. I am used to working in repos where the PR description gets folded into the squashed commit, so didn't think to update the commit message.

@CramBL

[CramBL]

I've messaged @elpiel and we need him to take action before we can merge this. The issue is that the msrv job has the specific rust version in the job name, and it's configured to be a required job, but it no longer exists since you bumped the msrv, so we need to fix the configuration.

[elpiel]

All good imo.
Not sure why we left ~3.11

[CramBL]

All good imo. Not sure why we left ~3.11

Yes probably just an oversight or an attempt to be rigorous with compatibility.

We still need the changes to CI to be able to merge this and future PRs.

[elpiel]

Done. This requires a Minor update though so keep that in mind @CramBL