fix(deps): move zbus_xml to 5.2.1, clearing the quick-xml 0.38 advisories (#231)

Stacked on #222 (← #221 ← #220 ← #218).

## What

Lockfile-only bump of `zbus_xml` 5.1.0 → 5.2.1. This removes the last
`quick-xml 0.38.4` from `Cargo.lock` and clears:

- RUSTSEC-2026-0194: quadratic attribute checking in quick-xml
- RUSTSEC-2026-0195: unbounded namespace allocation in quick-xml

## Why no upstream PR or `[patch]` is needed

The handoff plan assumed every `zbus_xml` 5.x release still used
`quick-xml ^0.38`. crates.io shows otherwise:

| zbus_xml | XML parser |
|---|---|
| 5.1.0 (was locked) | quick-xml ^0.38 |
| 5.1.1 | quick-xml ^0.39 |
| 5.2.0, 5.2.1 | winnow ^1.0 (no quick-xml) |

`zbus-lockstep 0.5.2` (via `atspi-common 0.13`) requires `zbus_xml
^5.0.2`, so 5.2.1 is a semver-compatible resolution. The fix is already
published upstream; the lockfile simply had not picked it up.

## Side effects in the lockfile

All behind the opt-in `gui` feature. Default builds are unchanged.

- `zvariant` / `zvariant_derive` 5.10.0 → 5.15.1
- `zbus_names` 4.3.1 → 4.3.5
- adds `winnow 1.0.4`, `zvariant_utils 4.2.0`, `zcheapstr 1.1.0`, `syn
3.0.3` (proc-macro only)

Every new crate declares `rust-version` ≤ 1.87, the floor the previously
locked `zvariant 5.10.0` already set. The `gui` MSRV does not move.

## Verification (local, Rust 1.99.0)

- `cargo audit`: before, 2 vulnerabilities, exit 1. After, 0
vulnerabilities, exit 0, with zero ignores and no `audit.toml`.
- The same five `unmaintained` warnings appear before and after:
ttf-parser, unsafe-libyaml, zbus_names, zvariant, zvariant_derive.
- `cargo check --all-features --all-targets`: pass
- `cargo clippy --all-features --all-targets -- -D warnings`: pass
- `cargo test --all-features`: all suites pass

## Follow-up (not in this PR)

`zvariant`, `zvariant_derive` and `zbus_names` gained `unmaintained`
notices on 2026-10-16 because they were folded into zbus 6. These are
warnings, not failures. They clear only when accesskit/atspi move to
zbus 6.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath