fix(deps): bump rustls to 0.23.46 for RustSec advisories

[thebrandonlucas]

Problem

The RustSec audit fails on master (since #32) and on every open pull request. The lockfile pins rustls 0.23.45, which four advisories published on 2026-10-14 affect:

Advisory	Title
RUSTSEC-2026-0346	Debug impls for client session values expose TLS secrets
RUSTSEC-2026-0347	Buffered application data sent to outer server after ECH rejection
RUSTSEC-2026-0348	Brotli certificate decompression can allocate up to 1 GiB before authentication
RUSTSEC-2026-0349	Unauthenticated ServerHello can downgrade later connections to classical key exchange

Change

Bump the exact pin in Cargo.toml and the lockfile from 0.23.45 to 0.23.46, which fixes all four. No other dependency changes.

Validation

• cargo fmt --check, cargo clippy --locked --all-targets -- -D warnings, and cargo test --locked pass locally.
• The local cargo-audit is too old to read the current advisory database, so the PR's "Audit locked dependencies against RustSec" job is the audit result.

Follow-up

The open stack (#20 → #22 → … → #30) needs a rebase onto master after this merges to clear its audit failures. The audit also reports three informational unmaintained warnings (zbus_names, zvariant, zvariant_derive). They do not fail the job and are not addressed here.