Update Rust dependencies, embed runtime.js, and tighten seccomp rules

[jonathannen]

Motivation

• Bring direct Rust dependencies up to recent mutually-compatible releases so the project builds against modern deno_core/V8 and ecosystem fixes.
• Adapt the extension-loading approach to the newer deno_core behavior by embedding the runtime JavaScript into the binary so the runtime can locate its ESM sources at runtime.
• Harden and narrow seccomp allowlists to match V8/tokio runtime behavior (allow safe descriptor queries and necessary madvise operations) while preserving the sandbox tripwires.

Description

• Updated dependency versions in Cargo.toml and refreshed the lockfile (Cargo.lock) to pick up deno_core = "0.410.0", deno_error = "0.7.1", libc = "0.2.189", tokio = "1.53.1", seccompiler = "0.5.0", and several transitive updates.
• Adapted src/runtime.rs to embed the runtime.js ESM file into the deno_core extension at runtime by importing ExtensionFileSource and registering the embedded file via deno_core::ascii_str_include! in a hermit_extension() helper and using that when constructing the JsRuntime.
• Tightened seccomp rules in src/seccomp.rs: added allow_fcntl_getfd() and enabled fcntl(F_GETFD) in both stage-1 and stage-2 filters so V8 can query descriptor flags without allowing descriptor duplication or mutation, and added MADV_DODUMP to the safe madvise allowlist to accommodate V8’s restore-of-dump-behavior sequence while continuing to block concealment/unsafe madvise flags.
• Small formatting and defensive cleanup in sandbox and runtime plumbing to ensure robust syscall and resource-limit handling under the new dependency set.

Testing

• Ran cargo +1.91.1 test --all-targets and observed all automated tests pass (unit tests and integration suite: 12 unit tests and 73 integration tests passed). ✅
• Ran cargo +1.91.1 clippy --all-targets -- -D warnings with no warnings (clippy clean). ✅
• Ran formatting and repository checks (cargo +1.91.1 fmt -- --check and git diff --check) as part of the verification; the codebase compiles and the test suite succeeds with the updated dependencies. ✅

---

Codex Task