Move compiletest off the deprecated serde_yaml #5000

Cargo Deny started failing on RUSTSEC-2024-0449: unsafe-libyaml is unmaintained and has no fixed release. We only pull it in through serde_yaml, which is itself deprecated, and the only user is compiletest. It parses the config.yml of the exec-mode tests (tools/compiletest/src/runtest.rs, run_exec_test).

#4987 adds the advisory to the ignore list in deny.toml to unblock CI. That's safe for now because compiletest is test tooling and isn't shipped. Once compiletest uses a maintained YAML crate (the advisory suggests serde-saphyr), we should remove that entry.

The 97 config.yml files only have flat keys (script, expected, exit_code), so swapping the parser should be a small change.