chore(deps): accept RUSTSEC-2026-0285 until the rustls fix clears cooldown

[henry40408]

Summary

• The deny CI gate started failing on every branch after RUSTSEC-2026-0285 was published against rustls 0.23.37 (GHSA-2mjx-qc3c-rqvc, same bug class as Go's CVE-2025-61730). It is not introduced by any pending change — rustls arrives transitively through reqwest → hyper-rustls / tokio-rustls.
• Add the advisory to the [advisories].ignore list in deny.toml with the usual rationale + exit condition comment, so the supply-chain gate stops blocking unrelated PRs (currently chore(deps): bump taiki-e/install-action from 2.87.4 to 2.87.11 in the github-actions group across 1 directory #560 and chore(deps): bump the cargo group with 3 updates #561).

Why this is safe to accept temporarily

rustls is only used as an outbound HTTPS client (feed fetches, image proxy). The advisory is that a peer can send handshake messages in plaintext that should have been encrypted, without rustls rejecting the connection; the handshake transcript stays authenticated, so a network-position attacker cannot alter or complete a handshake with it.

Exit condition

The fix is rustls >= 0.23.45, published 2026-09-14T15:11Z. Under this project's 168-hour dependency cooldown it becomes adoptable on 2026-09-21. Follow-up tracked in #563 — the ignore entry gets dropped in the same change as the bump.

Test plan

• cargo deny check locally → advisories ok, bans ok, licenses ok, sources ok
• CI deny job green on this PR

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.06%. Comparing base (b5cab98) to head (4c69691).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #562      +/-   ##
==========================================
- Coverage   94.06%   94.06%   -0.01%     
==========================================
  Files          93       93              
  Lines       26459    26459              
==========================================
- Hits        24889    24888       -1     
- Misses       1570     1571       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.