fix: refresh Rust audit dependencies

[matthewod11-stack]

Summary

• bump pdf-extract from 0.10 to 0.12 to clear the fixed lopdf advisory path
• bump calamine from 0.26 to 0.35 so spreadsheet parsing is on the current upstream line
• document and temporarily ignore the unresolved upstream quick-xml advisories that still arrive through current calamine/docx-rs/Tauri plist releases

Verification

• cargo test — 788 passed, 0 failed, 2 ignored
• cargo audit --ignore RUSTSEC-2023-0071 --ignore RUSTSEC-2026-0194 --ignore RUSTSEC-2026-0195 — exits 0; warnings only
• cargo metadata --no-deps — metadata parses

Notes

This does not pretend the quick-xml parser DoS advisory is gone. It reduces the dependency drift we can fix today and keeps the remaining upstream limitation explicit in the audit workflow instead of leaving main red.

[Copilot]

Pull request overview

This PR refreshes Rust dependencies and updates the security workflow so cargo audit stays green while explicitly documenting and temporarily ignoring remaining upstream quick-xml advisories.

Changes:

• Bumped Rust parser dependencies (calamine to 0.35, pdf-extract to 0.12) to reduce dependency drift and clear fixed advisory paths.
• Updated the GitHub Actions security workflow to ignore the currently-unresolved quick-xml RustSec advisories and documented why they’re still present transitively.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src-tauri/Cargo.toml	Updates dependency versions for spreadsheet and PDF parsing crates.
.github/workflows/security.yml	Documents and applies cargo audit ignores for the remaining upstream quick-xml advisories.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.