chore: update vulnerable dependencies

- aws-lc-rs 1.16.0 → 1.16.2 (pulls aws-lc-sys 0.37.1 → 0.39.0)
  Fixes RUSTSEC-2026-0045, -0046, -0047, -0048 (AES-CCM timing,
  X.509 name constraints bypass, CRL scope check, PKCS7 verify bypass)
- rustls-webpki 0.103.9 → 0.103.10
  Fixes RUSTSEC-2026-0049 (CRL distribution point matching)
- Fix clippy push_str single-char lint in model_switch.rs

Note: rustls-webpki 0.102.8 remains (pinned by rumqttc 0.25.1,
no upstream update available yet).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: qhkm

Cargo.lock

@@ -277,7 +277,7 @@ pub fn format_model_list(
         output.push('\n');
     }
 
-    output.push_str("\n");
+    output.push('\n');
     output.push_str("Switch model:  /model <model-id>\n");
     output.push_str("With provider: /model <provider>:<model-id>\n");
     output.push_str("Reset:         /model reset\n");