deps: remove quick-xml/glib advisory ignores once upstream GUI deps update

[wksantiago]

Tracks deny.toml advisory ignores and known-but-unmitigated advisories in keep-desktop's transitive GUI tree. None are reachable from the signing/network/key-handling path. main is not branch-protected, so cargo-deny is a signal, not a merge gate.

Ignored today (load-bearing) — RUSTSEC-2026-0194 / -0195 (quick-xml)

• quick-xml <0.41 quadratic dup-attr check + NsReader unbounded namespace alloc (memory-exhaustion DoS).
• Path: wayland-scanner (pins ^0.39) -> winit -> iced -> keep-desktop; also tauri-winrt-notification. Only build-time protocol XML / self-generated Windows toast XML, never untrusted input.
• Tree: quick-xml 0.37.5 and 0.39.4, both below the 0.41.0 fix.
• Remove the ignores once wayland-scanner/winit adopt quick-xml >= 0.41.

Known, NOT mitigated — waiting on upstream

• RUSTSEC-2024-0429 (glib): glib 0.18 unsound VariantStrIter via gtk 0.18 (tray/notify) -> keep-desktop. No fixed release on the gtk 0.18 path; resolves on gtk-rs 0.20 migration (see also RUSTSEC-2024-0415). Left as a reported advisory rather than adding an ignore, since cargo-deny is not a gate.
• RUSTSEC-2026-0186 (memmap2): unchecked pointer offset, via desktop windowing crates only. Patched in 0.9.11; bump deferred (not on the signing/network path).

[kwsantiago]

Checked whether the quick-xml ignores can come out yet. They cannot, and the check is cheap to repeat.

Both versions in the tree are still below the fixed release: quick-xml 0.37.5 and 0.39.4, against a fix that landed in 0.41.0. cargo update -p quick-xml@0.37.5 and -p quick-xml@0.39.4 both lock zero packages, so no newer compatible version exists within the ranges their parents allow. The parents are unchanged: wayland-scanner and tauri-winrt-notification, neither of which has moved to a fixed line, so the ignores are still load-bearing rather than stale.

cargo deny check advisories currently passes. Removing the ignores now would turn that red for a path that is build-time protocol XML and self-generated Windows toast XML, never untrusted input.

Re-check by running the two cargo update --dry-run commands above and confirming they still lock zero packages. The condition to close this is the parents adopting quick-xml 0.41 or later, not anything in this repository.