Security audit CI failing: RUSTSEC-2026-0382 (rustls-webpki) and RUSTSEC-2026-0383 (webpki-root-certs) #26549

The Security audit workflow (ci/scripts/security_audit.sh) now fails on main because of two new RustSec advisories against crates in Cargo.lock:

• rustls-webpki 0.103.15: RUSTSEC-2026-0382, "Certificate verification may accept distrusted intermediates". Fixed in 0.103.16.
• webpki-root-certs 1.0.9: RUSTSEC-2026-0383, "Bundled root certificates allow trust in distrusted emSign intermediates". Fixed in 1.0.10.

Both are pulled in through the TLS stack used by object_store / reqwest and the AWS SDK.

To Reproduce

bash ci/scripts/security_audit.sh
# error: 2 vulnerabilities found!

Expected behavior

cargo audit passes.

Additional context

Patched versions are semver-compatible, so cargo update -p rustls-webpki@0.103.15 -p webpki-root-certs fixes it with a lockfile-only change. I'm happy to open a PR.