Bump webpki crates to clear the RustSec audit (#19308)

<!--
Thanks for contributing to Nushell!

Before submitting, please read the contributing guide:
https://github.com/nushell/nushell/blob/main/CONTRIBUTING.md

This template helps reviewers understand your changes and allows us to
generate high-quality release notes.
-->

## Description

The `Security audit` job fails on every PR that touches `Cargo.toml` or
`Cargo.lock` (for example #19306). The advisory database now flags three
crates for CVE-2026-111943. Their certificate checks can accept chains
through emSign intermediates whose private keys have leaked. Each crate
has a patched release, so this PR moves all three to it:

| Crate | Old | New | Advisory | Pulled in by |
| --- | --- | --- | --- | --- |
| `rustls-webpki` | 0.103.15 | 0.103.16 | RUSTSEC-2026-0382 | `rustls`
(all TLS connections) |
| `webpki-roots` | 1.0.9 | 1.0.10 | RUSTSEC-2026-0381 | `nu-command`
(direct workspace dependency) |
| `webpki-root-certs` | 1.0.6 | 1.0.10 | RUSTSEC-2026-0383 |
`rustls-platform-verifier` (wasm32 only) |

`webpki-roots` is a direct workspace dependency, so `Cargo.toml` now
requires the patched `1.0.10` instead of only pinning it in the
lockfile. The other two crates are transitive, so only `Cargo.lock`
changes for them (`cargo update -p rustls-webpki -p webpki-roots -p
webpki-root-certs`). Nothing else in the lockfile moves.

<!--
Explain what this PR does and why.

This section is intentionally flexible:
- Describe the problem
- Explain your approach
- Include technical details if relevant

Good examples:
- "In this PR, I fixed..."
- "In this PR, I added support for..."
- "This change improves X by..."

Write as much or as little as needed for reviewers to understand your
changes.
-->

## User-facing changes (Release notes)

- Bumped `rustls-webpki`, `webpki-roots` and `webpki-root-certs` for
CVE-2026-111943 (distrusted emSign intermediates).

<!--
This section is used (mostly as-is) for https://www.nushell.sh/blog/

Describe how Nushell behavior changes from a user's perspective.
Do NOT describe internal Rust changes here.

Write in a release note style, for example:
- "Added support for..."
- "Fixed an issue where..."
- "Nushell now supports..."
- "Improved performance of..."

If your changes do NOT affect users (internal refactors, cleanup, etc.),
just write:
- "n/a"
- "nan"
- or similar

This tells us the change should not appear in the changelog.

Tips:
- Focus on observable behavior
- Include examples if helpful
- Keep it concise

You can:
- Write a short paragraph (will appear as a bullet point), OR
- Use headings (###) if your change needs more structure

Avoid writing things like:
- "In this PR, I refactored..."
- "This updates internal code..."

You may leave this blank until the PR is ready.
-->

## Additional notes

- `cargo audit` 0.22.2 (advisory database of 2026-10-21) on main's
`Cargo.lock`: 3 vulnerabilities, exit 1. On this branch: 0
vulnerabilities, exit 0.
- `cargo audit` still warns that `bincode` (RUSTSEC-2025-0141) and
`yaml-rust` (RUSTSEC-2024-0320) are unmaintained, the same as on main.
These warnings are informational, so the job does not fail on them.
- CI's clippy step (`clippy --workspace --all-targets --profile ci -- -D
warnings` with `.cargo/ci.toml`, plugins included) and `cargo nuclippy`
both pass on macOS.
<!--
Optional.

Examples:
- fixes #123
- closes #456
- related #789

Anything else reviewers should know.
Remove this section if not needed.
-->

Cargo.lock

@@ -8278,9 +8278,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.15"
+version = "0.103.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
 dependencies = [
  "aws-lc-rs",
  "ring",
@@ -10487,18 +10487,18 @@ dependencies = [
 
 [[package]]
 name = "webpki-root-certs"
-version = "1.0.6"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "804f18a4ac2676ffb4e8b5b5fa9ae38af06df08162314f96a68d2a363e21a8ca"
+checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb"
 dependencies = [
  "rustls-pki-types",
 ]
 
 [[package]]
 name = "webpki-roots"
-version = "1.0.9"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
+checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9"
 dependencies = [
  "rustls-pki-types",
 ]

Cargo.toml

@@ -295,7 +295,7 @@ v_htmlescape = "0.17.0"
 memchr = "2.8.0"
 wax = "0.7.0"
 web-time = "1.1.0"
-webpki-roots = "1.0.9"
+webpki-roots = "1.0.10"
 which = "8.0.6"
 win_uds = "=0.2.4"
 windows = "0.62.2"