Fix security dependency alerts and lock CI builds

[minto-dane]

Motivation

• Address security and yanked-dependency alerts in the dependency graph and ensure CI validates the committed lockfile rather than resolving fresh dependencies during workflow runs.
• Reduce risk from deprecated serde_yaml by switching to a maintained YAML backend compatible with existing imports.
• Prevent CI from silently pulling newer dependency sets during scheduled/security checks by enforcing reproducible builds.

Description

• Replace direct serde_yaml dependency with serde_yaml_ng while keeping the serde_yaml crate name in manifests by using a package alias in Cargo.toml and fuzz/Cargo.toml.
• Update Wasmtime/Cranelift-related versions in Cargo.toml and Cargo.lock (Wasmtime -> 43.0.1, Cranelift -> 0.130.1, gimli -> 0.33.0, and related lockfile adjustments) to move off deprecated/yanked selections.
• Harden GitHub Actions by adding --locked to cargo invocations across .github/workflows/ci.yml and .github/workflows/security.yml (tests, build, clippy, nextest, llvm-cov, audit/deny/geiger, miri, benches, etc.).
• Tidy the lockfile to reflect the chosen patched versions and remove entries that were replaced as part of the remediation.

Testing

• Ran cargo fmt --all --check, which succeeded.
• Ran git diff --check and cargo metadata --locked --format-version=1 --no-deps, both succeeded and validated workspace/lockfile coherence checks.
• Ran repository scans with rg patterns to verify serde_yaml/Wasmtime/Cranelift changes, which matched the expected replacements.
• Attempted cargo check --locked --workspace --all-features, but the run was blocked by the environment failing to download crates from crates.io (network/proxy returned CONNECT tunnel failed, response 403), so a full locked build could not be completed in this environment.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: be3939f946

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Remove unsupported --locked from cargo audit

When the CI audit job runs, this invocation passes --locked to the external cargo-audit binary rather than to Cargo itself; cargo --help shows --locked as a top-level Cargo option before COMMAND, and RustSec's current cargo-audit CLI options do not define a --locked flag. As a result, the audit job will fail on argument parsing before scanning Cargo.lock, so the security check is broken instead of locked.

Useful? React with 👍 / 👎.