[shadowhand]

Summary

Bump rustls from 0.23.45 to 0.23.46 to clear four RustSec advisories:

• RUSTSEC-2026-0346 — Debug impls for client session values expose TLS secrets (medium)
• RUSTSEC-2026-0347 — buffered application data sent to outer server after ECH rejection (low)
• RUSTSEC-2026-0348 — brotli certificate decompression can allocate up to 1 GiB before authentication (low)
• RUSTSEC-2026-0349 — unauthenticated ServerHello can downgrade later connections to classical key exchange (low)

Lockfile-only change; no source changes.

Verification

• cargo audit — no vulnerabilities
• cargo test — pass
• cargo clippy --all-targets --all-features -- -D warnings — clean
• cargo fmt --check — clean