Remove RUSTSEC-2026-0258 (h2 0.3.27) suppression once chdb-rust drops reqwest 0.11

[genezhang]

Context

In PR #1097 we fixed RUSTSEC-2026-0258 (h2 unbounded empty DATA frames) by upgrading the server path to h2 0.4.16. A second, residual copy of h2 (0.3.27) remained and is currently suppressed with justification rather than fixed.

Why it's suppressed, not fixed

• The residual h2 0.3.27 is pulled in only under --all-features via the optional embedded feature's chain: chdb-rust 1.3.1 → reqwest 0.11.27 → h2 0.3.x.
• The advisory is patched only in >=0.4.16 — there is no 0.3.x backport.
• chdb-rust 1.3.1 pins reqwest ^0.11, so h2 0.3.x cannot be upgraded out of the tree without dropping or replacing chdb-rust.
• Severity is low, it's an outbound-client-only path, and it's off the default (server) build.

This mirrors the existing handling of RUSTSEC-2025-0134 (rustls-pemfile), which travels the same chdb-rust → reqwest 0.11 chain.

Where the suppression lives

• deny.toml — RUSTSEC-2026-0258 in the [advisories] ignore list (with justifying comment)
• .github/workflows/security.yml — cargo audit --ignore ... --ignore RUSTSEC-2026-0258

Action to take (when unblocked)

When chdb-rust releases a version that depends on reqwest 0.12 (which uses h2 0.4.x):

1. Bump chdb-rust in Cargo.toml and run cargo update.
2. Confirm no h2 0.3.x remains: cargo tree -i h2 --all-features.
3. Remove RUSTSEC-2026-0258 from the ignore list in deny.toml (and its comment).
4. Remove --ignore RUSTSEC-2026-0258 from .github/workflows/security.yml.
5. Verify cargo deny check advisories --all-features and cargo audit pass.

References

• Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0258
• Fix PR: docs(demos): add DeltaGraph/Databricks demo notebooks and schemas #1097