Security: Rust dependency advisories — RSA Marvin (no fix) + 2 unmaintained crates (deps-audit waivers)

[SharedQA]

Summary

The deps-audit gate (cargo-audit, added in #1317) surfaces three Rust advisories in the dependency tree. None has a drop-in fix today, so they are waived with documented --ignore entries in security-gates.yml to keep the gate blocking for new/fixable advisories. This issue tracks removing each waiver as fixes land.

Advisories (all transitive)

ID	Crate	Type	Note
RUSTSEC-2023-0071	rsa	Vulnerability (medium 5.9)	"Marvin Attack" RSA timing side-channel. No fixed upstream release exists. Arrives via sqlx-mysql. Remove waiver when a patched rsa ships.
RUSTSEC-2024-0436	paste	Unmaintained	Transitive macro dep; no drop-in replacement. Remove when parents migrate.
RUSTSEC-2026-0173	proc-macro-error2	Unmaintained	Transitive. Remove when parents migrate.

Acceptance

• Each waiver removed from security-gates.yml as its advisory is resolved (patched rsa, or the unmaintained crates dropped from the tree).
• No new advisories accumulate silently — the gate stays --deny warnings for everything else.

[SharedQA]

Re-ran cargo-audit 0.22.2 against the merged-main lockfile (08f0527, post-#1314, 596 crate deps). The advisory set is unchanged — same three, no new ones introduced by the gears migration:

• RUSTSEC-2023-0071 (rsa — Marvin, no fix available)
• RUSTSEC-2024-0436 (paste — unmaintained)
• RUSTSEC-2026-0173 (proc-macro-error2 — unmaintained)

The --ignore waivers in #1317's deps-audit step remain valid and complete. No action needed from the #1314 merge.