ci(deny): ignore quick-xml RUSTSEC-2026-0194/0195 pending upstream bump (#193)

Both advisories are DoS-via-untrusted-XML in quick-xml < 0.41. The sole
consumer is wayland-scanner, a build-time proc-macro parsing vendored
Wayland protocol XML; no untrusted XML is parsed at runtime, so neither
issue is reachable in the shipped binary. wayland-scanner 0.31.10
(latest) still pins quick-xml ^0.39 — drop these ignores when it moves
to 0.41.

Closes #192.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: thewrz

deny.toml

@@ -17,6 +17,13 @@ ignore = [
     # ttf-parser is unmaintained; transitive via iced's font stack. No safe
     # upgrade is available until iced/cosmic-text/winit move off it upstream.
     { id = "RUSTSEC-2026-0192", reason = "transitive via iced font dependencies, no patched version available upstream" },
+    # quick-xml < 0.41 DoS via untrusted XML (quadratic attribute check /
+    # unbounded namespace allocations). Sole consumer here is wayland-scanner,
+    # a build-time proc-macro parsing the vendored Wayland protocol XML — no
+    # untrusted XML is ever parsed at runtime. wayland-scanner 0.31.10 (latest)
+    # still requires quick-xml ^0.39; drop both ignores when it moves to 0.41.
+    { id = "RUSTSEC-2026-0194", reason = "build-time only: wayland-scanner proc-macro parses vendored protocol XML, never untrusted input; no upstream release requires the patched quick-xml 0.41 yet" },
+    { id = "RUSTSEC-2026-0195", reason = "build-time only: wayland-scanner proc-macro parses vendored protocol XML, never untrusted input; no upstream release requires the patched quick-xml 0.41 yet" },
 ]
 
 # ── Licenses ──────────────────────────────────────────────────────────────────