fix(deps): update dependencies for GA

[catinspace-au]

The GA dependency pass for the loader, on top of the scalo 2.14 move in #238.

• scalo 2.14.0 -> 2.14.1, and cel 0.13 -> 0.14.5, the range scalo's expression API returns. ONE cel in the lock.
• Computed fields and routing rules need no code change: the Value, objects::Key and Program::execute shapes the loader reads are unchanged in cel 0.14. cel 0.14 makes contains() string-only; the only contains in a shipped or test rule is message.contains("audit") on a string.
• Every other direct dependency is at its newest release in its major: test-case 3.4.0, thiserror 2.0.21, tokio 1.53.2, tokio-test 0.4.6, uuid 1.27.0. Floors raised to match. Covers fix(deps): update rust-dependencies #236.
• testcontainers stays on 0.27: testcontainers-modules 0.15.0, the newest, still requires it.
• reqwest stays on 0.12. 0.13 drops the rustls-tls-native-roots feature the GeoIP download trusts the system store through, so moving it changes how that client verifies a server. The Cargo.toml and renovate notes said it was held "to match scalo", which stopped being true at scalo 2.14.1 (scalo is on 0.13); they now give the real reason.
• Kafka test fixture pinned to apache/kafka 4.3.1 by digest.
• ClickHouse 26.3.42.3 and Redpanda v26.2.3, by digest, in the test fixture, the dev compose and the PGO workload. Renovate's ClickHouse ceiling moves to 26.3.42.
• ci.yml dispatch: optimize-tier input and passthrough added, and the input descriptions match the other apps. The named secrets block is unchanged.
• osv-scanner ignore for GHSA-w9wp-h8wv-79jx: the reason now names the blocker (metrics-exporter-opentelemetry 0.2.1 requires opentelemetry ^0.31) and the tracker, Move the OpenTelemetry stack off 0.31 once metrics-exporter-opentelemetry publishes scalo-rs#281, instead of the closed scalo-rs#34/chore(licence): finish the FSL-1.1-ALv2 -> BUSL-1.1 rename #100.

Proof, run locally on rustc 1.99.0:

• cargo nextest run (default features, Docker unreachable): 1860 passed, 19 skipped. The Docker-backed tests return early locally; CI runs them. CEL tests among them: the eleven routing::router::tests::test_cel_rule_* and a_cel_routed_record_is_named_not_a_fallback, and the five transform::computed::tests::test_cel_to_json_*.
• cargo clippy --all-targets -- -D warnings on each quality feature set (default, default+jemalloc, default+testcontainers, default+transport-memory): clean.
• hyperi-ci check --quick: quality complete; cargo audit, cargo deny and osv-scanner pass. Without the ignores the lock reports opentelemetry_sdk 0.31.0 GHSA-w9wp-h8wv-79jx and paste 1.0.15 RUSTSEC-2024-0436, both on the ignore list.
• Regenerated the Dockerfile, chart and config schema on scalo 2.14.1: no diff.
• Optimisation resolves pgo=on, bolt=on.
• cargo tree -d: one cel (0.14.5, shared with scalo). Remaining duplicate majors are transitive: base64 0.22/0.23, compact_str 0.9/0.10, reqwest 0.12 beside the dev-only 0.13 testcontainers takes, socket2 0.5/0.6.
• dfe-infra check_member_pins.py logic on this branch's HEAD: 8 pins, 0 edits.

The .cargo/config.toml [build] target-cpu=native line behind the cargo-flags CI warning (#218) is unchanged here.

[github-actions]

Released in v1.18.46 -- https://github.com/hyperi-io/dfe-loader/releases/tag/v1.18.46