fix: bump quinn-proto and ammonia past RustSec advisories

[seamus-sloan]

Summary

• Bump quinn-proto 0.11.15 → 0.11.19 for RUSTSEC-2026-0338 to 0342
• Bump ammonia 4.1.4 → 4.1.7 for RUSTSEC-2021-0157
• Lockfile only; 4.1.7 avoids the 4.2 line's html5ever 0.40 bump

Test plan

• cargo test -p omnibus-db on the ammonia-backed modules: 77 passed
• 🔒 Cargo Audit Required reports no advisories

Version

By default a merge to main cuts a patch release. Pick the version update this PR should trigger; labels override the default:

• Minor — add the minor version label (vX.Y.Z → vX.(Y+1).0).
• Patch — the default; add the patch version label or leave unlabeled (vX.Y.Z → vX.Y.(Z+1)).
• No release — add the no release label to skip cutting a release.

If both minor version and patch version are applied, minor version wins. Unlabeled PRs that only touch docs (*.md, docs/) or CI (.github/) skip the release automatically.

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[github-actions]

cargo-audit

No RustSec advisories found in Cargo.lock ✅

_{Posted by the Rust workflow's security job.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!