[wenbinf]

Updating the SDK's Cargo.lock does not constrain dependency versions in consuming applications. Add webpki-root-certs = "1.0.10" to Cargo.toml and record the direct dependency in Cargo.lock so consumers cannot retain an older 1.0.x root bundle lacking the emergency emSign distrust update.

Validation:

• Rust 1.88 and stable: 8 client tests and 33 doctests passed on each toolchain; the opt-in network suite remained skipped.
• Formatting, Clippy with warnings denied, and documentation with warnings denied passed.
• An independent consumer builds with 1.0.10 and rejects an explicit downgrade to 1.0.9 because of the SDK's manifest constraint.
• The packaged crate builds and includes the dependency minimum in its normalized manifest.

Packaging reports a pre-existing yanked yoke-derive 0.8.3 lockfile entry. Broader dependency updates are outside this change.