chore(deps): bump rustls-webpki from 0.103.3 to 0.103.15

[dependabot]

Bumps rustls-webpki from 0.103.3 to 0.103.15.

Release notes

Sourced from rustls-webpki's releases.

v/0.103.15

Fixes docs.rs build errors.

What's Changed

• Cargo: avoid all-features in docs.rs by @​cpu in rustls/webpki#530

Full Changelog: https://github.com/rustls/webpki/compare/v/0.103.14..v/0.103.15

v/0.103.14

What's Changed

• [0.103] Support stable ML-DSA by @​djc in rustls/webpki#523
• [0.103] Mark ML-DSA algorithms as FIPS submitted by @​djc in rustls/webpki#525

Full Changelog: rustls/webpki@v/0.103.13...v/0.103.14

0.103.13

• Fix reachable panic in parsing a CRL. This was reported to us as GHSA-82j2-j2ch-gfr8. Users who don't use CRLs are not affected.
• For name constraints on URI names, we incorrectly processed excluded subtrees in a way which inverted the desired meaning. See rustls/webpki#471. This was a case missing in the fix for GHSA-965h-392x-2mh5.

What's Changed

• Actually fail closed for URI matching against excluded subtrees by @​djc in rustls/webpki#473
• Prepare 0.103.13 by @​ctz in rustls/webpki#474

Full Changelog: rustls/webpki@v/0.103.12...v/0.103.13

0.103.12

This release fixes two bugs in name constraint enforcement:

• GHSA-965h-392x-2mh5: name constraints for URI names were ignored and therefore accepted. URI name constraints are now rejected unconditionally. Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.
• GHSA-xgp8-3hg3-c2mh: permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name. This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of reject.example.com which is outside the constraint. This is very similar to CVE-2025-61727.

Since name constraints are restrictions on otherwise properly-issued certificates, these bugs are reachable only after signature verification and require misissuance to exploit.

What's Changed

• Prepare 0.103.12 by @​djc in rustls/webpki#470

Full Changelog: rustls/webpki@v/0.103.11...v/0.103.12

0.103.11

In response to #464, we've slightly relaxed requirements for anchor_from_trust_cert() to ignore unknown extensions even if they're marked as critical. This only affects parsing a TrustAnchor from DER, for which most extensions are ignored anyway.

What's Changed

• Backport parsing trust anchors with unknown critical extensions to 0.103 by @​djc in rustls/webpki#466

0.103.10

... (truncated)

Commits

• c14836d Cargo: version 0.103.14 -> 0.103.15
• 5c92308 Cargo: avoid all-features in docs.rs
• 10a1514 Mark ML-DSA algorithms as FIPS submitted
• 14cbaa1 Bump version to 0.103.14
• cbb868a Support stable ML-DSA with aws-lc-rs
• c782fd1 Update to aws-lc-rs 1.18
• b250e31 Upgrade to base64 0.23
• 99115b2 ci: sync cargo-check-external-types nightly
• a82bfae crl: fix clippy::question_mark finding
• 2879b2c Prepare 0.103.13
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[Murasko]

@dependabot rebase

[Murasko]

lgtm, pipelines passed, cargo update somehow missed this. Also, security.