fix(deps): bump tauri-winrt-notification to drop vulnerable quick-xml (closes #89)

[pmaxhogan]

Summary

Fixes #89. cargo deny check was ignoring two quick-xml DoS advisories
(RUSTSEC-2026-0194, RUSTSEC-2026-0195) against quick-xml 0.37.5, pulled in
via:

quick-xml 0.37.5 <- tauri-winrt-notification 0.7.2 <- notify-rust 4.18.0
    <- tauri-plugin-notification <- driven-app

No [patch.crates-io] override was needed. tauri-winrt-notification 0.7.3 was published to crates.io on 2026-07-02 and drops the quick-xml
dependency entirely (upstream: tauri-apps/winrt-notification#53, "Drop
quick-xml dependency"). 0.7.3 is semver-compatible with notify-rust's
existing ^0.7 requirement, so this is a plain cargo update -p tauri-winrt-notification lockfile bump - no [patch.crates-io] block, no
git-source pin, no code change. (The issue was filed assuming 0.7.2 was
notify-rust's latest available bump target and that a semver-major jump to
0.8.x, or an upstream notify-rust release, would be required - that's no
longer the case now that 0.7.3 exists.)

The other vulnerable copy noted in the issue (quick-xml 0.39.4 <- plist 1.9.0 <- tauri-utils) was already resolved on main prior to this PR via a
routine dependabot bump to plist 1.10.0 (quick-xml ^0.41).

cargo tree -i quick-xml

Before:

quick-xml v0.37.5
└── tauri-winrt-notification v0.7.2
    └── notify-rust v4.18.0
        └── tauri-plugin-notification v2.3.3
            └── driven-app v2.0.1

quick-xml v0.41.0
└── plist v1.10.0
    └── ... (tauri-utils, already fixed pre-PR)

After:

quick-xml v0.41.0
└── plist v1.10.0
    └── ... (tauri-utils)

The vulnerable quick-xml 0.37.5 copy is gone from the tree entirely; only
the already-fixed quick-xml 0.41.0 (>= the 0.41.0 threshold both
advisories are fixed in) remains.

Changes

• Cargo.lock: tauri-winrt-notification 0.7.2 -> 0.7.3 (drops its
  quick-xml dependency; Cargo.toml is unchanged).
• deny.toml: remove the now-unused RUSTSEC-2026-0194 /
  RUSTSEC-2026-0195 ignore entries and their justification comment.

Verification

• cargo deny check: advisories ok, bans ok, licenses ok, sources ok.
• cargo check --workspace: green (covers the Windows-only
  tauri-winrt-notification notification path on this Windows host).
• cargo test -p driven-app --lib: 228 passed, 0 failed.

Test plan

• cargo tree -i quick-xml shows no quick-xml < 0.41.0 in the tree
• cargo deny check is green with the two RUSTSEC ignores removed
• cargo check --workspace compiles clean
• cargo test -p driven-app --lib passes

Closes #89

🤖 Generated with Claude Code

https://claude.ai/code/session_01QZQVP2tUuTLh8oL31D8heC

[github-actions]

Coverage

Area	main	this PR	delta
Rust (lib crates)	78.70%	78.70%	+0.00 (OK)
UI (vue/ts)	88.58%	88.58%	+0.00 (OK)

Gate: passed - no coverage regression (epsilon 0.1 pp).