chore(deps): bump quinn-proto to 0.11.15 in the lockfile

[dobby-coder]

Clears GHSA-4w2j-m93h-cj5j (high), the only open runtime-scope Dependabot alert on this repo.

Advisory	Severity	Package	Current	Fixed in
GHSA-4w2j-m93h-cj5j	high	quinn-proto	0.11.14	0.11.15

Lockfile-only — quinn-proto is transitive (QUIC support reached through the reqwest stack), so no Cargo.toml declares it and there is no version constraint to relax. The whole change is two lines in the root Cargo.lock.

Separate from #195, which tracks the rand 0.8 → 0.9 major and is still blocked upstream. This one has no such coupling.

Verification

A bare cargo test --workspace fails to compile on this tree by design — pg-core's tests are gated behind its test feature, as CLAUDE.md documents — so I verified per crate the way build.yml does. I confirmed that workspace-level failure reproduces unchanged on main, so it is not from this bump.

• cargo test --manifest-path pg-core/Cargo.toml --features test,rust,stream — 67 passed, 0 failed
• cargo test --manifest-path pg-{pkg,cli,ffi}/Cargo.toml --all-features — 69 passed, 0 failed
• cargo clippy --all-targets -- -D warnings on all four crates — clean
• cargo fmt --all -- --check — clean
• cargo build --workspace — succeeds
• cargo build --profile edge --bin pg-pkg — succeeds (CLAUDE.md asks for this specifically on a dependency bump, since the Dockerfile's Rust pin differs from the CI toolchain)

Because this touches the root Cargo.lock, it also trips the wire-compat-rust path filter, so the cross-version wire-compatibility gate will run on this PR — which is the right check for a lockfile change and I'd expect it to pass, as no serialization crate moved.

pg-wasm and pg-compat are excluded from the workspace and carry their own lockfiles, so neither is affected.