chore(deps): bump deps and acknowledge new RUSTSEC advisories

- ci: cargo-binstall v1.18.0 → v1.18.1 in CI workflows
- v2: fastify 5.8.1 → 5.8.5, brace-expansion 5.0.2 → 5.0.5, yaml 2.8.2 → 2.8.3
- v3: jsonschema 0.45 → 0.46 with updated Cargo.lock
- audit-ignore: add RUSTSEC-2026-0098/0099 (rustls-webpki via AWS SDK,
  unfixable until AWS SDK drops rustls 0.21 transitive dependency)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: pacphi

.github/workflows/ci-v3.yml

@@ -104,7 +104,7 @@ jobs:
           workspaces: v3 -> target
 
       - name: Install cargo-binstall
-        uses: cargo-bins/cargo-binstall@v1.18.0
+        uses: cargo-bins/cargo-binstall@v1.18.1
 
       - name: Install cargo-machete
         run: cargo binstall cargo-machete --no-confirm
@@ -229,7 +229,7 @@ jobs:
           workspaces: v3 -> target
 
       - name: Install cargo-binstall
-        uses: cargo-bins/cargo-binstall@v1.18.0
+        uses: cargo-bins/cargo-binstall@v1.18.1
 
       - name: Install cargo-llvm-cov
         run: cargo binstall cargo-llvm-cov --no-confirm --force
@@ -524,7 +524,7 @@ jobs:
         uses: dtolnay/rust-toolchain@stable
 
       - name: Install cargo-binstall
-        uses: cargo-bins/cargo-binstall@v1.18.0
+        uses: cargo-bins/cargo-binstall@v1.18.1
 
       - name: Install cargo-audit
         run: cargo binstall cargo-audit --no-confirm

v2/docker/lib/extensions/vf-management-api/resources/package-lock.json

@@ -40,7 +40,7 @@ serde_json = "1.0"
 serde_yaml_ng = "0.10"
 
 # JSON Schema validation
-jsonschema = "0.45"
+jsonschema = "0.46"
 
 # Template rendering
 tera = "1.20"

v3/Cargo.lock

@@ -3,3 +3,11 @@
 # Cannot upgrade: aws-smithy-http-client 1.1.12 (latest) still depends on rustls 0.21.x
 # Remove this entry once AWS SDK drops the rustls 0.21 dependency
 RUSTSEC-2026-0049
+
+# RUSTSEC-2026-0098: rustls-webpki Name constraints for URI names were incorrectly accepted
+# RUSTSEC-2026-0099: rustls-webpki Name constraints were accepted for certificates asserting a wildcard name
+# Both affect rustls-webpki 0.101.7 via aws-smithy-http-client -> rustls 0.21.12
+# Cannot upgrade: same AWS SDK transitive constraint as RUSTSEC-2026-0049
+# Remove these entries once AWS SDK drops the rustls 0.21 dependency
+RUSTSEC-2026-0098
+RUSTSEC-2026-0099