chore(deps): pin aws-lc-rs <1.18 to retain AWS-LC-FIPS 3.x backend

[lucaspimentel]

Overview

Pins the FIPS crypto backend directly: adds aws-lc-rs = { version = ">=1, <1.18" } as an optional dependency activated by the fips feature, and removes the rustls <0.23.45 cap introduced by #1389.

Capping rustls did not reliably constrain the transitive crypto backend: rustls 0.23.37 still permits aws-lc-rs 1.18, which switches to AWS-LC-FIPS 4.x. AWS-LC-FIPS 4.x has not completed FIPS 140-3 certification; only the 3.x module is NIST CMVP validated. The backend itself is therefore pinned as a direct dependency even though the crate does not call aws-lc-rs APIs directly, following the approach in DataDog/saluki#2348 and DataDog/serverless-components#173. The pin participates in resolution for both the default and FIPS builds, so a future cargo update can no longer silently re-select aws-lc-rs 1.18.

Package	Before	After
rustls	0.23.37	0.23.43
rustls-webpki	0.103.13	0.103.13 (unchanged)
aws-lc-rs	1.16.2	1.17.4
aws-lc-fips-sys	0.13.13	0.13.17
aws-lc-sys	0.39.0	0.45.0 (required by aws-lc-rs 1.17.4)

RUSTSEC-2026-0285 is only fixed in rustls >= 0.23.45, which stays out of range, so the existing waiver in bottlecap/.cargo/audit.toml (and the matching ignore in rs_ci.yml) is intentionally preserved. This change does not fix that advisory.

Removal criteria: lift the aws-lc-rs <1.18 bound and remove the RUSTSEC-2026-0285 waiver (from bottlecap/.cargo/audit.toml and rs_ci.yml, then re-bump rustls) once AWS-LC-FIPS 4.x certification is verified. Once DataDog/serverless-components#173 merges, this local pin can instead be dropped by bumping the serverless-components git rev (currently 3ab01258, kept aligned across the datadog-fips, dogstatsd, datadog-agent-config, and datadog-agent-trace-sampler dependencies).

Testing

• cargo metadata --locked (plain and --all-features) succeeds in bottlecap/ without modifying the lockfile.
• cargo tree --locked -i aws-lc-rs resolves to a single aws-lc-rs 1.17.4 for both the default and FIPS builds; the FIPS build activates its fips feature, resolving to aws-lc-fips-sys 0.13.17.
• ./scripts/verify_tls_root_features.sh passes: default build keeps webpki roots, FIPS build keeps native roots.
• cargo clippy --workspace --all-targets passes for both --features default and --no-default-features --features fips with RUSTFLAGS=-D warnings.
• cargo nextest run --workspace --locked: 690 passed, 0 failed.
• cargo fmt --all -- --check passes.
• dd-rust-license-tool check passes with no changes to LICENSE-3rdparty.csv.
• cargo audit exits 0: RUSTSEC-2026-0285 is ignored, only the 9 pre-existing allowed warnings remain.