ci: pin rust-cache to the commit its version comment names

[kingchenc]

Closes the 19 open zizmor/ref-version-mismatch code-scanning alerts.

All 19 uses of Swatinem/rust-cache across ci.yml, release.yml and
bench.yml pinned commit e18b497 with the comment # v2. The tag has since
moved to 6323deb, and no tag points at e18b497 any more — so the comment
asserted a version the pin does not have. That is what zizmor reports, once per
use.

A stale version comment is worse than no comment: it invites a reviewer to trust
a claim that no longer holds, while the code actually running is an unlabelled
commit. The pin now names the release it really is, v2.9.2 — verified by
resolving the tag to 6323deb102c322ba6fcbdcafc7e3dddab59af2b6.

Every other pinned action was checked the same way, by resolving each comment's
tag against its pinned SHA. All 25 agree, so this was the only one adrift.

The three remaining alerts are not fixable in code

Two Dependabot alerts, pytest < 9.0.3 (GHSA-6w46-j5rx-g56g). The patched
release requires Python >= 3.10, and the file it is reported against —
.github/requirements/ci-dev-py39.txt — exists precisely to serve the 3.9
matrix rows. #383 already froze pytest there for this reason. The 3.10+ rows use
ci-dev-py3.txt, which is on 9.0.3 and unaffected.

The advisory concerns pytest's handling of /tmp/pytest-of-{user}. This suite
never creates that directory: it uses no tmp_path, tmpdir or
tmp_path_factory fixture anywhere, which I confirmed by running it and
comparing the directory before and after — unchanged. The vulnerable path is
never taken, so adding a --basetemp guard would be a flag protecting a code
path that is not exercised.

One Scorecard alert, pipCommand not pinned by hash at ci.yml:550. That
line is pip install --no-index --find-links dist … wickra, which installs the
wheel built two steps earlier. --no-index means no index is consulted at all,
so the risk the rule guards against cannot occur, and a freshly built artifact
has no upstream hash to pin. Rewriting it to a glob path to satisfy the
heuristic would churn an install step that runs across twelve job instances and
three operating systems, for no security gain.

All three want dismissal with a reason rather than a code change.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!