[MadLittleMods]

Update rustls-webpki to distrust eMudhra Intermediate certificates (release notes)

Part of https://github.com/element-hq/backend-internal/issues/306

Related to #20387

We already use the system CA store when making requests in our Rust code (using the rustls-tls-native-roots (docs) feature with reqwest). For a system that already has a patched system CA store, bumping rustls-webpki is simply extra protection as it actively blocks those untrusted certs. For an unpatched system CA store, this provides a stop-gap.

Dev notes

$ cargo tree --invert rustls-webpki
rustls-webpki v0.103.16
└── rustls v0.23.45
    ├── hyper-rustls v0.27.7
    │   └── reqwest v0.12.28
    │       └── synapse v0.1.0 (/home/eric/Documents/github/element/synapse/rust)
    ├── reqwest v0.12.28 (*)
    └── tokio-rustls v0.26.2
        ├── hyper-rustls v0.27.7 (*)
        └── reqwest v0.12.28 (*)

Pull Request Checklist

• Pull request is based on the develop branch
• Pull request includes a changelog file. The entry should:
  • Be a short description of your change which makes sense to users. "Fixed a bug that prevented receiving messages from other servers." instead of "Moved X method from EventStore to EventWorkerStore.".
  • Use markdown where necessary, mostly for code blocks.
  • End with either a period (.) or an exclamation mark (!).
  • Start with a capital letter.
  • Feel free to credit yourself, by adding a sentence "Contributed by @github_username." or "Contributed by [Your Name]." to the end of the entry.
• Code style is correct (run the linters)

[MadLittleMods]

Thanks for the review @reivilibre 🦢