storage: ignore new RUSTSEC advisories for hickory-proto and rustls-webpki

Add three new security advisory exceptions to deny.toml for dependencies used in the storage port work.

hickory-proto v0.25.2 issues (RUSTSEC-2026-0118, RUSTSEC-2026-0119) are not exploitable in Nydus since we only use TokioResolver for simple A/AAAA queries without DNSSEC validation or multi-record messages.

rustls-webpki v0.103.12 CRL parsing panic (RUSTSEC-2026-0104) cannot be triggered as Nydus does not enable certificate revocation list verification.

Signed-off-by: Peng Tao <bergwolf@hyper.sh>

Author: bergwolf

deny.toml

@@ -47,6 +47,9 @@ ignore = [
     { id = "RUSTSEC-2025-0010", reason = "ring v0.16.20 is unmaintained but pinned by transitive deps from dragonfly-client-util. Cannot upgrade without upstream changes." },
     { id = "RUSTSEC-2023-0071", reason = "rsa v0.9.10 Marvin Attack timing side-channel. Transitive dep from dragonfly-client-util -> reqsign -> opendal. No safe upgrade available." },
     { id = "RUSTSEC-2025-0134", reason = "rustls-pemfile v2.2.0 is unmaintained (archived). Transitive dep from dragonfly-client-util. No safe upgrade available." },
+    { id = "RUSTSEC-2026-0118", reason = "hickory-proto v0.25.2 NSEC3 loop only affects DNSSEC validation (DnssecDnsHandle). Nydus uses TokioResolver for plain IP lookups without DNSSEC. Transitive dep via storage/hickory-resolver 0.25." },
+    { id = "RUSTSEC-2026-0119", reason = "hickory-proto v0.25.2 O(n^2) label compression in BinEncoder only triggers with many-record messages. Nydus only sends simple single-record A/AAAA queries; the encoding path cannot be reached by external input. Transitive dep via storage/hickory-resolver 0.25." },
+    { id = "RUSTSEC-2026-0104", reason = "rustls-webpki v0.103.12 CRL parsing panic is only reachable when certificate revocation lists are configured. Nydus does not enable CRL verification. Transitive dep from reqwest/hyper-rustls." },
 ]
 # Threshold for security vulnerabilities, any vulnerability with a CVSS score
 # lower than the range specified will be ignored. Note that ignored advisories