fix(security): suppress RUSTSEC-2024-0436 + fix 6 npm CVEs in mcp docs server (#16)

Rust / cargo-audit:
- Add .cargo/audit.toml to document and suppress RUSTSEC-2024-0436
  (paste 1.0.15 unmaintained). The advisory is a WARNING, not a
  vulnerability — paste has no CVE score. It enters the dependency
  graph only through the optional rvm-gpu webgpu feature:
    rvm-gpu (cuda-rust-wasm, off by default) -> wgpu -> wgpu-hal
    -> metal (macOS only) -> paste
  No fix is available without an upstream cuda-rust-wasm/wgpu release.
  The ignore entry is annotated with full justification.
- cargo audit, cargo clippy -D warnings, cargo fmt --check, and
  cargo test --workspace all pass clean (882 tests, 0 failures).

Node / npm (userguide/mcp):
- npm audit fix: resolved 6 CVEs in transitive deps of @modelcontextprotocol/sdk:
  * fast-uri <= 3.1.1: HIGH — path traversal via percent-encoded dot
    segments (GHSA-q3j6-qgpj-74h6) + host confusion via percent-encoded
    authority delimiters (GHSA-v39h-62p7-jpjc) → bumped to 3.1.2
  * hono <= 4.12.17: MODERATE — cookie name injection, path traversal in
    toSSG(), middleware bypass, JWT NumericDate validation, cache leakage,
    bodyLimit bypass, JSX HTML injection (multiple GHSAs) → bumped to 4.12.22
  * @hono/node-server < 1.19.13: MODERATE — middleware bypass via repeated
    slashes in serveStatic (GHSA-92pp-h63x-v22m) → bumped to 1.19.14
  * ip-address <= 10.1.0: MODERATE — XSS in Address6 HTML-emitting methods
    (GHSA-v2v4-37r5-5v8g) → bumped to 10.2.0
  * express-rate-limit 8.0.1-8.5.0: MODERATE — depends on vulnerable
    ip-address → bumped to 8.5.2
  * qs 6.11.1-6.15.1: MODERATE — DoS via null entries in comma-format
    arrays (GHSA-q8mj-m7cp-5q26) → bumped to 6.15.2
  npm audit now reports 0 vulnerabilities.

Author: ruvnet

.cargo/audit.toml

@@ -0,0 +1,18 @@
+# cargo-audit configuration for the RVM workspace.
+# See: https://github.com/rustsec/rustsec/tree/main/cargo-audit
+
+[advisories]
+# RUSTSEC-2024-0436: `paste` crate is unmaintained.
+# This is a *transitive* warning from a deeply nested optional dependency:
+#   rvm-gpu (optional cuda-rust-wasm feature) -> wgpu -> wgpu-hal -> metal -> paste
+# The workspace itself does not depend on `paste` and the GPU feature is
+# disabled by default (no `webgpu`/`metal` feature flag in any default build).
+# The `paste` crate has no known security vulnerability -- only maintenance
+# concerns. Suppressed until cuda-rust-wasm or wgpu ships a compatible release
+# that removes the metal -> paste dependency.
+ignore = ["RUSTSEC-2024-0436"]
+informational_warnings = ["unmaintained", "unsound", "notice"]
+
+[output]
+show_tree = true
+quiet = false