chore(deps): bump openssl to 0.10.81 and rustls-webpki to 0.103.13

[bdelanghe]

Discharges #90 and #88, open since 2026-06-23. Both dependencies are transitive — openssl via native-tls, rustls-webpki via rustls — so this is a lockfile-only change. cargo update -p openssl -p rustls-webpki resolves to exactly the versions both PRs propose, plus openssl-sys 0.9.109 → 0.9.117 as openssl's companion.

Verified against OSV, not the release notes

The release notes undercount this considerably:

package	before	after
rustls-webpki	0.103.4 — 8 advisories	0.103.13 — CLEAN
openssl	0.10.73 — 8 advisories	0.10.81 — CLEAN
openssl-sys	0.9.109 — clean	0.9.117 — clean

16 cleared in total, including GHSA-82j2-j2ch-gfr8 (reachable panic parsing a CRL) and RUSTSEC-2026-0049 (CRLs not treated as authoritative by distribution point — affects >=0.102.0-alpha.0 <0.103.10, so 0.103.4 was squarely in range).

cargo check --workspace --locked --all-targets passes. The 7 xtask warnings it prints are pre-existing visibility lints in wasm_event_bus, untouched by this change.

Why these sat for seven weeks looking harmless

The deps lane has been green over all 16 of them, because it scans nothing. From the last scheduled run on main (2026-08-04):

Scanning dir .
End status: 170 dirs visited, 1617 inodes visited, 0 Extract calls
No package sources found
No issues found

0 Extract calls — it never opened Cargo.lock. The cause is .gitignore:7, which lists Cargo.lock while the file is tracked. That rule is inert for git (git exempts tracked files, which is why git status is clean and nobody noticed), but osv-scanner applies the pattern literally and skips the repo's only lockfile. --allow-no-lockfiles then turns "scanned nothing" into a pass.

Not a quirk of the shared lane — front-desk-scheduler runs the identical workflow and reports 3 Extract calls, including a Cargo.lock with 31 packages. It simply has no such .gitignore line.

That fix is not in this PR: Cargo.lock is baked into xtask's generator in two places (generate_full_gitignore() and the --minimal ignorable_patterns list), so it needs a code change plus regeneration plus a checksum update. Filed separately.

Sequencing is deliberate. This bump lands first so the scan does not go straight from blind to red — with 16 live advisories, unblinding the scanner before clearing them would red-line a hard-fail lane on main.

Leases held: PVTI_lADOESuYO84BawOLzgwn-d8 (#90) and PVTI_lADOESuYO84BawOLzgwn-c4 (#88), fencing 1 each.

---

Generated by Claude Code