Bump decimal and cowlib, ignore the Cloak advisories in hex.audit

[stuartc]

Description

mix hex.audit started failing CI on branches off main because of new advisories against cloak, cloak_ecto and decimal. Where a fix exists we take it, and where it doesn't we ignore the advisory after checking it can't reach us.

• decimal 3.1.1 → 3.2.0 fixes CVE-2026-97853 (Decimal.round/3 memory blow-up with a huge places). We don't call Decimal.round ourselves, but the bump is free.
• cowlib 2.20.0 → 2.21.0 fixes CVE-2026-43969, so that ignore is gone. CVE-2026-43966 is still unpatched and stays ignored.
• cloak CVE-2026-95105 (AES-CTR has no MAC) is ignored. Lightning.Vault only uses Cloak.Ciphers.AES.GCM, which authenticates its ciphertext. No fixed release exists; upstream issue CVE-2026-95105: AES.CTR cipher is unauthenticated (deprecate it in favour of AES.GCM?) danielberkompas/cloak#132.
• cloak_ecto CVE-2026-94206 (Cloak.Ecto.PBKDF2 ignores :iterations) is ignored. We define no PBKDF2 fields, only Cloak.Ecto.Binary and Cloak.Ecto.Map. No fixed release exists; upstream issue CVE-2026-94206: PBKDF2 type passes :size as the iteration count danielberkompas/cloak_ecto#66.

Validation steps

1. mix deps.get && mix hex.audit exits 0 and lists the three ignored advisories.
2. grep -rnE "AES\.CTR|PBKDF2" lib config finds nothing.

Additional notes for the reviewer

1. If anyone later adds a CTR cipher or a PBKDF2 field, these ignores will hide a real problem. The comment in mix.exs says so next to each one.

AI Usage

Please disclose whether you've used AI anywhere in this PR (it's cool, we just
want to know!):

• I have used Claude Code
• I have used another model
• I have not used AI

You can read more details in our
Responsible AI Policy

Pre-submission checklist

• I have performed an AI review of my code (we recommend using /review
  with Claude Code)
• I have implemented and tested all related authorization policies.
  (e.g., :owner, :admin, :editor, :viewer)
• I have updated the changelog.
• I have ticked a box in "AI usage" in this PR

[github-actions]

Verified: Lightning uses only Cloak.Ciphers.AES.GCM (lib/lightning/vault.ex:14) and no PBKDF2 fields anywhere in lib/ or config/, so the two added Cloak CVE ignores match the code. The diff is strictly mix.exs and mix.lock.

Security Review ✅

• S0 (project scoping): N/A, PR only touches mix.exs and mix.lock — no queries, controllers, or LiveView events changed.
• S1 (authorization): N/A, no new web-layer actions or policy modules.
• S2 (audit trail): N/A, no writes to config resources; only dependency version bumps and hex_audit advisory list edits, which the ignores' rationale (lib/lightning/vault.ex:14, no PBKDF2 usage) actually matches.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.4%. Comparing base (bc28b49) to head (9afebef).

Additional details and impacted files

@@          Coverage Diff          @@
##            main   #5246   +/-   ##
=====================================
  Coverage   91.4%   91.4%           
=====================================
  Files        465     465           
  Lines      23416   23416           
=====================================
+ Hits       21404   21410    +6     
+ Misses      2012    2006    -6     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.