deps: bump helios when it drops jsonrpsee 0.19 (clears 4 RUSTSEC advisories)

[sheb-gregor]

Why

The 2026-09-03 security scan (#185) found 8 advisories per workspace. One (h2 on the 0.4 line) was fixed by a lockfile bump. The remaining four are all pinned by one dependency: helios-ethereum (a16z/helios, tag 0.11.1), pulled in by the helios feature of utexo-bridge-enclave.

What helios pins

Advisory	Crate	Path from helios
RUSTSEC-2026-0258	h2 0.3.27	helios-core → jsonrpsee 0.19 → hyper 0.14
RUSTSEC-2026-0099 / -0104 / -0098	rustls-webpki 0.101.7	helios-core → jsonrpsee 0.19 → hyper-rustls 0.24 → rustls 0.21
RUSTSEC-2026-0119 / -0118	hickory-proto 0.25.2	helios-core → reqwest 0.12 → hickory-resolver 0.25
RUSTSEC-2025-0055	tracing-subscriber 0.2.25	revm 29 → ark-bn254 → ark-r1cs-std → ark-relations 0.5.1 (lockfile only — not compiled)

Why it is not fixable today

• 0.11.1 is the newest helios release.
• helios master still declares jsonrpsee = "0.19.0" in core/Cargo.toml, so no newer commit helps either.
• RUSTSEC-2026-0118 (hickory-proto NSEC3 unbounded loop) has no fixed version upstream at all.

Exit criteria

Close this when helios ships a release that drops jsonrpsee 0.19 (or moves it to hyper 1.x / rustls 0.23), then:

1. Bump the helios-ethereum tag in enclave/Cargo.toml.
2. Re-run cargo audit in . and parent/.
3. Remove the now-clear IDs from .cargo/audit.toml and parent/.cargo/audit.toml.
4. Expect a new PCR0 — the enclave binary changes, so the signer set must rotate.

Second, independent path

rustls-webpki 0.101.7 also arrives via rgb-ops → esplora-client 0.12 → minreq 2.14. That one is ours to bump in the RGB mirrors, and it is not covered by this issue. Bumping helios alone will not clear the three rustls-webpki advisories.

Ref: #185