deps: batch bump for 1.8.1

- quinn-proto 0.11.14 -> 0.11.16 (RUSTSEC-2026-0185, remote memory
  exhaustion via reqwest; unblocks CI cargo-audit)
- russh 0.61 -> 0.62 (also drops the yanked crypto-bigint 0.7.3)
- tower-http 0.6 -> 0.7
- rustls 0.23.42, uuid 1.24.0, socket2 0.6.5, serde_with 3.21.0,
  rand 0.10.2, webpki-roots 1.0.9, toml 1.1.3, cmov 0.5.4
- fuzz lockfile synced (russh, serde_with, cmov)

Clears the open dependabot queue (#164-#180).

Cargo.toml

@@ -8,7 +8,7 @@ description = "Lightweight Rust replacement for Apache Guacamole client"
 # Web framework
 axum = { version = "0.8", features = ["ws"] }
 tower = "0.5"
-tower-http = { version = "0.6", features = ["fs", "cors", "trace"] }
+tower-http = { version = "0.7", features = ["fs", "cors", "trace"] }
 
 # Async runtime
 tokio = { version = "1", features = ["full"] }
@@ -76,7 +76,7 @@ reqwest = { version = "0.12", features = ["json", "rustls-tls-native-roots"], de
 webpki-roots = "1"
 
 # SSH tunneling (jump host / bastion)
-russh = "0.61"
+russh = "0.62"
 
 # Docker (VDI container management)
 bollard = "0.21"