Fix the rust-tests CI gate: clippy 1.97 question_mark + cargo-audit (quick-xml/crossbeam)

[juangaitanv]

Fix the rust-tests CI gate (clippy 1.97 + cargo-audit)

Two pre-existing, repo-wide rust-tests (./harness ci) failures, both from CI toolchain/advisory-DB drift (not tied to any feature branch — they fail main and every PR):

1. clippy 1.97 newly flags a question_mark lint in src/verify_deps/registry.rs under -D warnings.
2. cargo audit hits 3 RustSec advisories.

This PR fixes both.

The rust-tests CI gate (./harness ci → cargo audit) fails on three RustSec advisories. These are advisory-DB triggered and repo-wide — because cargo audit fetches the live advisory database, any CI run today fails on them, on main and on every open PR (they are not tied to a feature branch). This clears them.

1. clippy question_mark (registry.rs)

Applied clippy's own ?-operator rewrite to the pre-existing PEP 440 suffix block. Semantically identical.

2. Advisories fixed (cargo audit)

Crate	Advisory	Issue	Fix
quick-xml 0.36.2	RUSTSEC-2026-0194	Quadratic run time scanning a start tag for duplicate attribute names (DoS)	≥0.41
quick-xml 0.36.2	RUSTSEC-2026-0195	Unbounded namespace-declaration allocation → memory-exhaustion DoS	≥0.41
crossbeam-epoch 0.9.18	RUSTSEC-2026-0204	Invalid pointer dereference in fmt::Pointer for Atomic/Shared	≥0.9.20

The two quick-xml advisories are DoS-on-malicious-XML, reachable via the SAST scan-report parsers (Checkmarx/Fortify/Coverity), so a real upgrade (not a suppression) is the right fix.

Changes

• Cargo.toml: quick-xml = "0.36.1" → "0.41".
• Cargo.lock: quick-xml → 0.41.0, crossbeam-epoch → 0.9.20 (transitive via ignore, lockfile-only).
• src/scanners/fortify.rs: quick-xml 0.41 deprecates Attribute::unescape_value; switched to normalized_value(XmlVersion::Implicit1_0). Identical output for file-path attributes (same entity resolution; whitespace normalization is a no-op for real paths). The Checkmarx and Coverity parsers compiled unchanged.

Not addressed

• git2 0.20.4 RUSTSEC-2026-0183 / 0184 (unsound) have no fixed release; they remain informational allowed warnings (cargo audit exits 0). Unchanged from before.

Verification

• cargo audit → exit 0 (0 vulnerabilities; 2 allowed git2 warnings).
• cargo clippy --all-targets -- -D warnings → clean.
• cargo test → all pass (437).
• cargo fmt --check → clean.

Follow-up

Unblocks all CLI PRs. COR-1646 (#126) will rebase on top once this merges.

[cursor]

Actionable finding:

• src/verify_deps/registry.rs:535 — the required rust-tests check currently fails before it reaches the audit step this PR is intended to fix. CI runs ./harness ci, which invokes cargo clippy --all-targets -- -D warnings (see harness:305-309 / .github/workflows/test.yml:32-33), and the PR run failed with error: this block may be rewritten with the ? operator at src/verify_deps/registry.rs:535 (clippy::question_mark, promoted to error by -D warnings). Impact: this PR cannot merge with the required gate red even if the dependency bumps are otherwise correct, so the cargo-audit fix remains unverified in CI. Concrete fix: update that else if let Some(r) = suffix.strip_prefix('c') { ... } else { return None; } tail to the clippy-suggested let r = suffix.strip_prefix('c')?; ... form, or pin/adjust the CI Rust/clippy toolchain if the project does not want new stable clippy lints to block unrelated PRs.

  

_{Sent by Cursor Automation: pr-flow}

[Ibrahimrahhal]

can you test fortify report uploads just so we are safe