rsa crate vulnerability fix

[joaofrf]

Describe the feature

The current version of the rsa crate used by zenoh-transport version 1.1.0 has a vulnerability
https://rustsec.org/advisories/RUSTSEC-2023-0071

It would be nice to have an alternative to this, since it has been an open issue on their end for quite a while and doesn't seem to be merged any time soon
RustCrypto/RSA#390

[joaofrf]

Note: unsure what label to set, since this is technically not a bug nor a "new feature"

[JEnoch]

An update on this long-standing issue:

At first I would like to clarify the current usage of rsa 0.9.x crate in Zenoh:

• rsais NOT used for TLS, mTLS and QUIC transport. Those are leveraging rustls and ring which don't suffer this vulnerability.
• rsa is used only for additional authentication feature when transport/auth/pubkey configuration is specified or when multilink is used.

We looked at replacing rsa usage with ring, but our current usage requires encrypt/decrypt feature than ring's rsa implementation doesn't provide.

For 1 year we've been closely monitoring the fix in rsa and it's release in a 0.10.0 version. However it's sill not there yet and will likely bump the MSRV to 1.85+, which will be problematic for ROS 2 support where Rust 1.75 is required for distros up-to Kilted.

Using signature or other algorithm than RSA would require protocol changes and that would be a breaking change which we're considering only for Zenoh 2.0.