chore: bump rustls-webpki to 0.103.15 in the lockfile

[prql-bot]

Problem

#6269 reports three RUSTSEC advisories reachable through tiberius. Investigating them showed the advisories are actually against rustls-webpki (not tiberius itself), and the lockfile reaches affected versions by two independent paths — only one of which involves tiberius:

path	rustls-webpki	affected?
tiberius 0.12.3 → tokio-rustls 0.24.1 → rustls 0.21.12	0.101.7	yes, and 0.101.x has no patched release
libduckdb-sys (build script) → reqwest 0.12.28 → hyper-rustls 0.27.7 → tokio-rustls 0.26.4 → rustls 0.23.37	0.103.9	yes — patched is >= 0.103.12 / >= 0.103.13

The tiberius path needs the crate swap #6269 proposes, which is blocked on aljazerzen/connector_arrow#81. The second path is fixable today with a lockfile bump, and would not have been cleared by the tiberius swap.

Solution

cargo update -p rustls-webpki@0.103.9 → 0.103.15, which is patched for all three advisories (2026-0098, 2026-0099, 2026-0104). Lockfile-only, three lines, no manifest change — hyper-rustls/rustls already accept this version under their existing requirements.

Scope

Low urgency, filed for hygiene rather than exposure: both paths sit behind test-only features (test-dbs / test-dbs-external), so no published prqlc artifact contains either. The remaining 0.101.7 entry is untouched by this PR and stays until the tiberius question in #6269 is resolved.

Testing

cargo metadata --locked --all-features resolves cleanly against the updated lockfile. Compilation of the affected path happens under the test-dbs feature in the tests matrix.

---

Refs #6269