chore(deps): move chacha20 off yanked 0.10.1 (#2357)

`cargo deny check advisories` flagged chacha20 0.10.1 as a yanked crate.
It reaches every bashkit crate through rand, turso_core via twox-hash, and
the SSH transport via russh and ssh-cipher/ssh-key. Upstream published
0.10.2 on 2026-08-27, which un-yanks the 0.10.x line, so pin the lockfile
to it and move the existing cargo-vet safe-to-deploy exemption to match.

Lockfile and supply-chain metadata only; no source changes.

Author: chaliy

Cargo.lock

@@ -289,7 +289,7 @@ version = "0.1.1"
 criteria = "safe-to-deploy"
 
 [[exemptions.chacha20]]
-version = "0.10.1"
+version = "0.10.2"
 criteria = "safe-to-deploy"
 
 [[exemptions.chrono]]