fix(deps): bump tauri-winrt-notification to drop vulnerable quick-xml (closes #89) (#129)

## Summary

Fixes #89. `cargo deny check` was ignoring two quick-xml DoS advisories
(RUSTSEC-2026-0194, RUSTSEC-2026-0195) against `quick-xml 0.37.5`,
pulled in
via:

```
quick-xml 0.37.5 <- tauri-winrt-notification 0.7.2 <- notify-rust 4.18.0
    <- tauri-plugin-notification <- driven-app
```

**No `[patch.crates-io]` override was needed.**
`tauri-winrt-notification
0.7.3` was published to crates.io on 2026-07-02 and drops the quick-xml
dependency entirely (upstream: tauri-apps/winrt-notification#53, "Drop
quick-xml dependency"). 0.7.3 is semver-compatible with notify-rust's
existing `^0.7` requirement, so this is a plain `cargo update -p
tauri-winrt-notification` lockfile bump - no `[patch.crates-io]` block,
no
git-source pin, no code change. (The issue was filed assuming 0.7.2 was
notify-rust's latest available bump target and that a semver-major jump
to
0.8.x, or an upstream notify-rust release, would be required - that's no
longer the case now that 0.7.3 exists.)

The other vulnerable copy noted in the issue (`quick-xml 0.39.4 <- plist
1.9.0 <- tauri-utils`) was already resolved on `main` prior to this PR
via a
routine dependabot bump to `plist 1.10.0` (quick-xml `^0.41`).

## cargo tree -i quick-xml

**Before:**
```
quick-xml v0.37.5
└── tauri-winrt-notification v0.7.2
    └── notify-rust v4.18.0
        └── tauri-plugin-notification v2.3.3
            └── driven-app v2.0.1

quick-xml v0.41.0
└── plist v1.10.0
    └── ... (tauri-utils, already fixed pre-PR)
```

**After:**
```
quick-xml v0.41.0
└── plist v1.10.0
    └── ... (tauri-utils)
```

The vulnerable `quick-xml 0.37.5` copy is gone from the tree entirely;
only
the already-fixed `quick-xml 0.41.0` (>= the 0.41.0 threshold both
advisories are fixed in) remains.

## Changes

- `Cargo.lock`: `tauri-winrt-notification` 0.7.2 -> 0.7.3 (drops its
  `quick-xml` dependency; `Cargo.toml` is unchanged).
- `deny.toml`: remove the now-unused `RUSTSEC-2026-0194` /
  `RUSTSEC-2026-0195` ignore entries and their justification comment.

## Verification

- `cargo deny check`: advisories ok, bans ok, licenses ok, sources ok.
- `cargo check --workspace`: green (covers the Windows-only
  `tauri-winrt-notification` notification path on this Windows host).
- `cargo test -p driven-app --lib`: 228 passed, 0 failed.

## Test plan

- [x] `cargo tree -i quick-xml` shows no `quick-xml < 0.41.0` in the
tree
- [x] `cargo deny check` is green with the two RUSTSEC ignores removed
- [x] `cargo check --workspace` compiles clean
- [x] `cargo test -p driven-app --lib` passes

Closes #89

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01QZQVP2tUuTLh8oL31D8heC

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: pmaxhogan

Cargo.lock

@@ -32,27 +32,6 @@ ignore = [
     "RUSTSEC-2025-0081",
     "RUSTSEC-2025-0098",
     "RUSTSEC-2025-0100",
-    # quick-xml DoS advisories, both fixed in quick-xml >=0.41.0:
-    #   RUSTSEC-2026-0194 - quadratic run time when checking a start tag for
-    #     duplicate attribute names.
-    #   RUSTSEC-2026-0195 - unbounded namespace-declaration allocation in
-    #     `NsReader` enables a memory-exhaustion denial of service.
-    # We carry two vulnerable copies, each transitively pinned via an
-    # intermediate that is ALREADY at its latest published crates.io version and
-    # has not yet bumped its quick-xml requirement to >=0.41:
-    #   quick-xml 0.37.5 <- tauri-winrt-notification 0.7.2 <- notify-rust
-    #     <- tauri-plugin-notification <- driven-app
-    # (The second vulnerable copy, via plist <- tauri-utils, was resolved
-    # 2026-07-19: plist 1.10.0 requires quick-xml ^0.41. The winrt chain is
-    # still pinned: tauri-winrt-notification 0.8.x dropped quick-xml entirely,
-    # but notify-rust 4.18 still requires ^0.7, so notify-rust must move.)
-    # No bump path exists at our layer: quick-xml >=0.41 crosses 0.x incompat
-    # boundaries upstream, so notify-rust must move first.
-    # Exposure is low - these paths only parse local / OS-generated XML (Windows
-    # toast notifications, macOS plists), never untrusted network input.
-    # Added 2026-07-03; remove when #89 closes.
-    "RUSTSEC-2026-0194",
-    "RUSTSEC-2026-0195",
 ]
 
 [licenses]