wasmtime/27.0.0-r0: cve remediation (#36258)

wasmtime/27.0.0-r0: fix GHSA-h97m-ww89-6jmq

Advisory data:
https://github.com/wolfi-dev/advisories/blob/main/wasmtime.advisories.yaml

---------

Signed-off-by: hbh7 <[email protected]>
Co-authored-by: octo-sts[bot] <[email protected]>
Co-authored-by: hbh7 <[email protected]>

Author: octo-sts[bot]

wasmtime.yaml

@@ -1,7 +1,7 @@
 package:
   name: wasmtime
   version: 28.0.0
-  epoch: 0
+  epoch: 1
   description: "A fast and secure runtime for WebAssembly"
   copyright:
     - license: Apache-2.0
@@ -25,6 +25,8 @@ pipeline:
       tag: v${{package.version}}
       expected-commit: 2e584e84127f0123c5a9211310140419e12082c2
 
+  - uses: rust/cargobump
+
   - name: Configure and build
     runs: |
       git submodule update --init

wasmtime/cargobump-deps.yaml

@@ -0,0 +1,4 @@
+packages:
+  # Newer version of url pulls in newer version of idna necesary to fix GHSA-h97m-ww89-6jmq CVE
+  - name: url
+    version: 2.5.4