fix(security): fix 4 security issues in quinn-proto, jsonptr, rand

[aikido-autofix]

Changes

Upgrade quinn-proto, jsonptr, and rand to fix DoS via stream exhaustion, JSON Pointer panic on untrusted input, and memory safety violations in deserialization and logging.

Fixes #(issue)

✅ 4 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-404995	HIGH	[quinn-proto] A vulnerability allows attackers to open an unbounded number of streams by sending a single malformed MAX_STREAM_DATA frame, causing denial of service through memory exhaustion or CPU consumption instead of properly rejecting the connection.
AIKIDO-2026-57390	MEDIUM	[jsonptr] A panic vulnerability in the delete module allows remote attackers to cause denial of service by crafting JSON Pointers with the - token or an index equal to array length, crashing applications that process untrusted input like JSON Patch operations.
AIKIDO-2026-875754	LOW	[rand] Deserialization of UniformChar bypasses validation, allowing an invalid Unicode range to be loaded. This can cause undefined behavior and memory safety violations when sampling from the corrupted distribution.
GHSA-cq8v-f236-94qc	LOW	[rand] The rand library is unsound when log and thread_rng features are enabled with a custom logger accessing rand::rng() during reseeding, causing aliased mutable references through unsafe code that violates Stacked Borrows rules, resulting in undefined behavior.

🔗 Related Tasks

• https://linear.app/elastiflow/issue/SEC-1084/aikido-fix-4-security-issues-in-quinn-proto-jsonptr-rand-mermin

Testing

Proof it works