fix(deps): update all dependencies to latest

[bryantbiggs]

Bumps everything to latest across Rust, the docs site, and GitHub Actions. Typed fix so cargo-release treats it as a patch and it lands in the changelog, since chore is skipped by cliff.toml.

• aws-lc-rs 1.17.3 -> 1.18.0, and aws-lc-fips-sys 0.13.16 -> 0.14.1 with it
• aws-config 1.10.0 -> 1.10.1, aws-sdk-ecr 1.122.0 -> 1.123.0, aws-sdk-ecrpublic 1.107.0 -> 1.108.0
• google-cloud-auth 1.14 -> 1.15
• rustls 0.23.42 -> 0.23.43, thiserror 2.0.19 -> 2.0.20, http 1.4.2 -> 1.5.0, schemars 1.2.1 -> 1.2.2
• astro 7.1.3 -> 7.2.1, @astrojs/markdown-remark 7.2.1 -> 7.2.2
• dorny/paths-filter v4.0.2 -> v4.0.3
• aws-actions/configure-aws-credentials v6.2.2 -> v6.2.3
• actions/attest-build-provenance v4.1.1 -> v4.2.2
• dtolnay/rust-toolchain moved to the current master commit

Both lockfiles were regenerated from scratch rather than updated in place. No source change was needed anywhere, and the docs bump clears the two open npm advisories (nanoid, postcss) that main carries.

The builder stage no longer pins gcc-13. That pin existed because the aws-lc-fips-sys delocator rejected .data.rel.ro.local sections emitted by GCC 14 and newer, and that no longer reproduces on 0.14.1, whose vendored delocator handles those sections. Verified by building the actual image with no gcc-13 package and no CC/CXX override, against the image default of GCC 16: the FIPS module compiles, the readelf ! NEEDED static assertion passes, and the resulting binary runs. Both the Docker and release matrices build on native runners, so host and target always match and an unset CC resolves per architecture. Closes #113.

Two dependencies are deliberately held back. testcontainers 0.28 reaches rustls/ring because bollard-buildkit-proto 0.8 turned on ureq/rustls in its default feature set, and a dependent cannot switch off a transitive's default features. Taking it means either letting a banned crypto crate into the graph or telling cargo-deny to skip dev-dependencies, and skipping them drops the license and unknown-source guards as well, since bans is the only check that ever failed. It also leaves rustls carrying both ring and aws-lc-rs, which makes its automatic provider selection return None and turns a missing install_crypto_provider() call into a panic instead of a no-op. base64 0.23 is held for a smaller reason: ocync-distribution would be the only consumer on that major, so it adds a second copy of base64 to the shipped binary and needs a permanent duplicate-version exemption, and the code only uses Engine, STANDARD and URL_SAFE_NO_PAD, all of which exist in 0.22. deny.toml is unchanged as a result.

The docs workflow pins node-version to a major instead of latest, so the Node toolchain cannot move under an unrelated commit. Everything else in this repo is pinned already.

Terraform is unchanged. Every module already resolved to its latest, and the provider floors were left as floors, matching what #110 did.

Manual review -- version-like values that need operator judgment, untouched:

• competitor tools built with @latest in bench/terraform/aws/user-data.sh:98,114,122,130, which undercuts the longitudinal comparison bench/results/{registry}.json exists for, given the Go toolchain right above them is pinned
• GO_VERSION = "1.26.2" in bench/terraform/aws/user-data.sh:65

Supersedes #112.