fix(deps): bump russh, jsonwebtoken, tar and npm lint deps

[alangou]

Summary

Bumps russh, jsonwebtoken, tar and the npm packages used by the mermaid docs linter to patched releases. The russh bump changed the channel-open authorization contract, so the sandbox SSH handler is ported and the forwarding policy is now covered by tests.

Related Issue

No issue required: mechanical dependency remediation.

Changes

Dependency	From	To
russh	0.61.2	0.62.5
jsonwebtoken	9.3.1	10.3.0
tar	0.4.45	0.4.46
uuid (lint-mermaid)	11.1.0	14.0.1
form-data (lint-mermaid)	4.0.5	4.0.6
ws (lint-mermaid)	8.20.0	8.21.2
mermaid (lint-mermaid)	11.14.0	11.16.0

Notes for review:

• jsonwebtoken 10.x requires selecting a crypto backend. aws_lc_rs is chosen because it succeeds the ring backend 9.x used and is already in the tree via russh, so no new build constraint. This also collapses a duplicate 9.3.1/10.3.0 pair into a single version shared with oci-client.
• russh 0.62 moves channel-open authorization from a returned bool to a reply handle. channel_open_direct_tcpip used that return value to confine forwarding to loopback destinations and to reject out-of-range ports, so both denial paths now call reply.reject(...) explicitly, and the accept is ordered before the relay task is spawned. Dropping the handle without replying rejects by default, so the handler fails closed.
• russh 0.62 also relaxes the exact release-candidate pins carried by 0.61, so ed25519-dalek, curve25519-dalek, elliptic-curve, p256/p384/p521 and ssh-encoding leave release-candidate status. That accounts for most of the Cargo.lock diff.
• On the npm side only the lockfile moved; package.json is unchanged and npm audit reports zero vulnerabilities.

Tests added:

• Three integration tests drive the real russh::server::Handler over an in-memory duplex, covering non-loopback rejection, out-of-range port rejection and loopback relay. The existing loopback_host_* tests only covered the predicate, not the wiring that applies it, so a mis-ported handler would have passed every test.
• Seven tests cover RS256 verification through JwksCache::new + validate_token against a mock issuer serving a real JWKS. That path had no coverage, which mattered because this changes the backend that verifies every user bearer token.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Full unit suite passes; openshell-server goes from 1233 to 1240 tests and openshell-supervisor-process from 197 to 200.

No new e2e tests, but the Docker-backed suite was run against a live gateway: gateway_smoke and port_forward_echo both pass. The latter drives a real system ssh -L through the sandbox, so it exercises the migrated accept path end to end.

Both new test groups were validated by mutation rather than just observed green. Turning each denial into an acceptance, dropping the reply handle, disabling signature validation, and disabling the issuer/audience/expiry checks each failed exactly the corresponding test and no others.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[github-actions]

Label test:e2e applied for 929c667. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.