Bump rustls-webpki to fix RUSTSEC-2026-0098/0099

rustls-webpki 0.103.10 has two advisories against it regarding
name constraint handling (URI names ignored; wildcard names accepted
under permitted subtree DNS constraints). Both are reachable only
after signature verification and require misissuance to exploit, but
cargo-deny blocks CI regardless.

Solution per the advisories: upgrade to >=0.103.12. `cargo update -p
rustls-webpki` picks 0.103.12 which is MSRV 1.85 compatible.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: algesten