chore(deps): bump quinn-proto to 0.11.19

[LKSNDRTMLKV]

What

Lock-only: quinn-proto 0.11.16 → 0.11.19.

Five RustSec advisories were published against 0.11.16 on 2026-10-12, and cargo audit (part of just check and the required Security audit check) now fails on main:

• RUSTSEC-2026-0338: remote peer can panic with zero-length STREAM frames during unordered reads (fixed in 0.11.18)
• RUSTSEC-2026-0339: unbounded growth of pending connection ID retirements (0.11.17)
• RUSTSEC-2026-0340: severity 7.5 (0.11.18)
• RUSTSEC-2026-0341: stream reassembly memory-exhaustion guard can be bypassed, severity 7.5 (0.11.17)
• RUSTSEC-2026-0342: zero-length DATAGRAM frames bypass the receive buffer limit (0.11.17)

Exposure

None in what ships. quinn-proto is in the lock only as an optional dependency of reqwest 0.13 (its HTTP/3 support), which no crate here enables: cargo tree -i quinn-proto --target all prints nothing. cargo audit reads the lock, not the build, so it fails anyway. The bump keeps the gate meaningful rather than adding an ignore.

Lock diff

quinn-proto version and checksum. cargo update -p quinn-proto also moved the Windows-only windows-sys edges of errno, rustix, tempfile, winapi-util, quinn-udp and rustls-platform-verifier from 0.52.0 to 0.60.2, both of which were already locked. No package is added or removed, and no source changes.

Checks

just check green (1489 tests), cargo audit clean.