ci: scan dependency advisories nightly and update XML parser (#605)

A scheduled/manual CI job scans locked dependencies for advisories, bans and unknown sources with cargo-deny 0.20.2 (never on pull requests, contents: read, no secrets). The first scan flagged quick-xml 0.38.4 (RUSTSEC-2026-0194/0195), so the workspace moves to quick-xml 0.41. Fixes #468.

Co-authored-by: lillith <[email protected]>

THIRD-PARTY-LICENSES.txt

@@ -1,6 +1,6 @@
 Third-party software in SolidCraft
 
-SolidCraft (the desktop app, solidcraft-cli and the web app) is built from the 454 crates below.
+SolidCraft (the desktop app, solidcraft-cli and the web app) is built from the 453 crates below.
 Generated by `cargo xtask licences` from Cargo.lock and the crates' own licence files.
 SolidCraft's own licence is in LICENSE-MIT and LICENSE-APACHE, and NOTICE.
 
@@ -262,7 +262,6 @@ proc-macro2 1.0.107  (MIT OR Apache-2.0)
 profiling 1.0.18  (MIT OR Apache-2.0)
 pxfm 0.1.30  (BSD-3-Clause OR Apache-2.0)
 quick-error 2.0.1  (MIT/Apache-2.0)
-quick-xml 0.38.4  (MIT)
 quick-xml 0.41.0  (MIT)
 quote 1.0.47  (MIT OR Apache-2.0)
 r-efi 5.3.0  (MIT OR Apache-2.0 OR LGPL-2.1-or-later)
@@ -8709,7 +8708,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
 ================================================================================
-quick-xml 0.38.4, quick-xml 0.41.0
+quick-xml 0.41.0
 ================================================================================
 
 The MIT License (MIT)