chore: batch housekeeping — CI, lint, deps (8 independently-authored PRs)

[m00grin]

Why I'm sending this

I'm a recent contributor to raspotify, a couple of PRs merged there this
week, so librespot staying healthy matters to me. The PR queue has grown
large, so I spent some time checking how much of it is safely combinable.
This is the mechanical end of it: CI config, dependency bumps, lint
cleanup. No behavior changes, no design decisions, nothing here has an
open question on its original thread.

What this is

A cherry-picked, authorship-preserved combination of 8 already-open PRs,
one commit per original PR (per CONTRIBUTING.md's guidance against
bundling multiple changes into one commit). Each commit is unmodified
from its original author except where noted, git blame still points to
them, not me:

• chore: remove async-trait #1637 — @photovoltex — chore: remove the now-unnecessary async-trait dependency
• chore: update crypto-common to v0.1.7 #1666 — @xtqqczze — chore(deps): bump crypto-common to v0.1.7
• clippy: enable implicit_clone lint #1667 — @xtqqczze — clippy: enable implicit_clone lint (see note below)
• fix: add fallback for vergen git values #1669 — @photovoltex — fix: fallback when vergen git values are unavailable
• chore: fix shuffle vec test #1670 — @photovoltex — chore: fix the flaky shuffle_vec test (closes Sporadic test failure: shuffle_vec::test::test_shuffle_with_first #1668,
  already been through a round of Copilot review that caught a real
  compile-breaking typo and a real infinite-loop risk, both fixed)
• ci: build also on macOS #1671 — @herrernst — ci: also build on macOS
• chore(deps): update rust crate quinn-proto to v0.11.15 #1696 — @xtqqczze — chore(deps): bump quinn-proto to v0.11.15 (RUSTSEC, closes RUSTSEC-2026-0037: Denial of service in Quinn endpoints #1697)
• ci: add security audit workflow #1698 — @xtqqczze — ci: add a daily cargo audit workflow

Note on #1667: its oauth/src/lib.rs hunk targeted code since
restructured by the build_token() extraction on dev. Reapplied the
same fix at the call sites it moved to, rather than drop it.

Verified on current dev

• cargo fmt --all -- --check, clean
• cargo clippy --workspace --all-targets -- -D warnings, zero warnings
  (rustls and native-tls both checked)
• cargo test --workspace, all green, including the flaky test chore: fix shuffle vec test #1670 targets
• Full CI matrix green: fmt, clippy, native cargo test (stable/1.85 ×
  ubuntu/macos/windows), and cross builds (armv7/aarch64/riscv64gc)

Not my call

Closing #1637/#1666/#1667/#1669/#1670/#1671/#1696/#1698 in favor of this,
if useful, is your decision. Happy to split it apart, drop pieces, or have
you cherry-pick from it directly instead of merging as-is. If it's not
useful, no worries, close it.