chore(deps): resolve rustls-webpki and webpki-roots emSign RustSec advisories (#2410)

* chore(deps): bump rustls-webpki to 0.103.16 (RUSTSEC-2026-0382)

rustls-webpki before 0.103.16 can accept certificate paths through the
distrusted emSign intermediates, whose private keys are now public,
when the configured trust anchors allow such paths. 0.103.16 rejects
paths containing those public keys.

0.103.16 was published on 2026-10-20, inside the 14-day publish-age
cooldown, so this resolve used the documented one-off override
`CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow`.

* chore(deps): bump webpki-roots and webpki-root-certs to 1.0.10

webpki-roots 1.0.9 (RUSTSEC-2026-0381) and webpki-root-certs 1.0.5
(RUSTSEC-2026-0383) bundle roots that let paths through the distrusted
emSign intermediates verify. 1.0.10 of both crates excludes them. This
is the root-store side of the incident that RUSTSEC-2026-0382 fixes in
rustls-webpki.

Both 1.0.10 releases were published on 2026-10-19, inside the 14-day
publish-age cooldown, so these resolves used the documented one-off
override `CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow`.

Author: storopoli