chore: modernize dependencies

[baszalmstra]

The dependency graph has accumulated several old or unmaintained crates, plus known vulnerabilities in both Cargo.lock and the bundled LLVM setup action. Updating the lockfile alone was not enough: a few of the affected dependencies needed replacements or API migrations.

This updates the Rust and npm dependencies, replaces the unmaintained pieces, and adds dependency audits to CI. The locked Rust graph goes from 543 packages to 297. cargo audit goes from 16 vulnerabilities to none, and npm audit for the LLVM action goes from three to none.

The larger migrations are:

• apple-codesign to arwen-codesign for ad-hoc Mach-O signing
• Salsa 0.16 to the maintained ra_ap_salsa fork
• notify 4/5 to notify 8
• tempdir, difference, paste, extendhash, and yansi-term to maintained alternatives
• the old lockfile crate to a small local RAII lock
• LSP, mdBook, pulldown-cmark, Rowan, and other compiler-guided API updates
• the custom LLVM action to Node 24 and current @actions/* packages

I deliberately left the LLVM 14/inkwell/lld stack alone because that needs to move as one unit. The mdBook library also stays on 0.4 because 0.5 no longer exposes a library target. A few other major updates, such as annotate-snippets, would require a disproportionate rewrite without fixing a current security issue.

This PR is stacked on #599.

Testing

• cargo fmt --all -- --check
• RUSTFLAGS=-Dwarnings pixi run check
• RUSTFLAGS=-Dwarnings pixi run clippy
• pixi run test
• workspace doctests and release build
• mdBook tests and book build
• generated-header freshness checks and 31 C++ tests
• cargo audit and npm audit
• actionlint and syntax checking of the bundled action

The new macOS signing path was not exercised locally on Windows, so I am leaving this as a draft until the macOS CI jobs have run. Please check that part closely.