fix(deps): drop vulnerable quick-xml via tauri-winrt-notification bump (closes #89)

quick-xml 0.37.5, pulled in transitively via
quick-xml <- tauri-winrt-notification 0.7.2 <- notify-rust <-
tauri-plugin-notification <- driven-app, was vulnerable to
RUSTSEC-2026-0194 and RUSTSEC-2026-0195.

tauri-winrt-notification 0.7.3 (published on crates.io, semver-compatible
with notify-rust's existing ^0.7 requirement) dropped the quick-xml
dependency entirely (tauri-apps/winrt-notification#53), so a plain
`cargo update -p tauri-winrt-notification` removes the vulnerable copy
from the tree without any [patch.crates-io] override or code change.
The other vulnerable copy (via plist <- tauri-utils) was already resolved
on main via a routine dependabot bump to plist 1.10.0 (quick-xml 0.41.0).

Remove the two now-unused RUSTSEC-2026-0194 / RUSTSEC-2026-0195 ignores
from deny.toml.

Closes #89

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QZQVP2tUuTLh8oL31D8heC

Author: pmaxhogan

Cargo.lock

@@ -32,27 +32,6 @@ ignore = [
     "RUSTSEC-2025-0081",
     "RUSTSEC-2025-0098",
     "RUSTSEC-2025-0100",
-    # quick-xml DoS advisories, both fixed in quick-xml >=0.41.0:
-    #   RUSTSEC-2026-0194 - quadratic run time when checking a start tag for
-    #     duplicate attribute names.
-    #   RUSTSEC-2026-0195 - unbounded namespace-declaration allocation in
-    #     `NsReader` enables a memory-exhaustion denial of service.
-    # We carry two vulnerable copies, each transitively pinned via an
-    # intermediate that is ALREADY at its latest published crates.io version and
-    # has not yet bumped its quick-xml requirement to >=0.41:
-    #   quick-xml 0.37.5 <- tauri-winrt-notification 0.7.2 <- notify-rust
-    #     <- tauri-plugin-notification <- driven-app
-    # (The second vulnerable copy, via plist <- tauri-utils, was resolved
-    # 2026-07-19: plist 1.10.0 requires quick-xml ^0.41. The winrt chain is
-    # still pinned: tauri-winrt-notification 0.8.x dropped quick-xml entirely,
-    # but notify-rust 4.18 still requires ^0.7, so notify-rust must move.)
-    # No bump path exists at our layer: quick-xml >=0.41 crosses 0.x incompat
-    # boundaries upstream, so notify-rust must move first.
-    # Exposure is low - these paths only parse local / OS-generated XML (Windows
-    # toast notifications, macOS plists), never untrusted network input.
-    # Added 2026-07-03; remove when #89 closes.
-    "RUSTSEC-2026-0194",
-    "RUSTSEC-2026-0195",
 ]
 
 [licenses]