fix(deps): upgrade dependencies to resolve RustSec advisories

[andborja]

Resolve all cargo-audit findings.

Before: 17 vulnerabilities and 4 warnings.
After: 0 vulnerabilities and 0 warnings.

Progression:

• cargo update -> 2 vulnerabilities, 1 warning
• quick-xml upgrade -> 0 vulnerabilities, 1 warning
• rustls-pemfile removal -> 0 vulnerabilities, 0 warnings

Vulnerabilities fixed (17):

• aws-lc-sys 0.32.2 (5): RUSTSEC-2026-0044/0045/0046/0047/0048
  (X.509 name-constraints bypass, PKCS7_verify chain/signature
  bypass, CRL distribution-point logic error, AES-CCM timing
  side-channel)
• rustls-webpki 0.103.7 (4): RUSTSEC-2026-0049/0098/0099/0104
  (name-constraint and CRL matching flaws, CRL-parsing panic)
• postgres-protocol 0.6.9 (2): RUSTSEC-2026-0179/0180
  (SCRAM CPU-exhaustion DoS, hstore decode panic)
• quick-xml 0.36.2 (2): RUSTSEC-2026-0194/0195
  (quadratic attribute check, unbounded namespace allocation DoS)
• bytes 1.10.1 (1): RUSTSEC-2026-0007 (integer overflow)
• crossbeam-epoch 0.9.18 (1): RUSTSEC-2026-0204 (invalid ptr deref)
• time 0.3.44 (1): RUSTSEC-2026-0009 (stack-exhaustion DoS)
• tokio-postgres 0.7.15 (1): RUSTSEC-2026-0178 (DataRow panic DoS)

Warnings fixed (4):

• rustls-pemfile 2.2.0: unmaintained (RUSTSEC-2025-0134)
• anyhow 1.0.100: unsound (RUSTSEC-2026-0190)
• rand 0.9.2: unsound (RUSTSEC-2026-0097)
• scc 2.4.0: unsound (RUSTSEC-2026-0205)

Changes:

• cargo update: compatible patch/minor bumps for aws-lc-sys, bytes,
  time, rustls-webpki, postgres-protocol, tokio-postgres,
  crossbeam-epoch, anyhow, rand and scc.
• server: bump quick-xml 0.36 -> 0.41 and adapt soap.rs to the new
  writer API (writer methods now return std::io::Error instead of
  quick_xml::Error).
• server: migrate TLS cert/key loading from the unmaintained
  rustls-pemfile crate to the rustls-pki-types PemObject API
  (already present transitively via rustls); existing error messages
  preserved.

Verification:

• cargo audit: 0 vulnerabilities, 0 warnings (exit 0).
• cargo build: full workspace builds clean.
• cargo test -p server: all tests pass, including TLS cert/key
  loading and SOAP serialization.

[andborja]

Hi @vruello, could you please review my PR?

Thanks!

[WilliamBruneau]

Hello,

Thanks for the PR !

It looks pretty solid. I will just run a few manual tests on a lab before merging.

[andborja]

Hello,

Thanks for the PR !

It looks pretty solid. I will just run a few manual tests on a lab before merging.

Thanks!

[WilliamBruneau]

Sorry for the delay, I finally was able to test it !

Thank you for the PR !