fix: update suppaftp to 12.0 and clear remaining audit advisories

[digizeph]

Summary

Security fix: suppaftp 7.0 is flagged by RUSTSEC-2026-0271 (FTP command injection via CRLF in control channel arguments, patched in >= 10.0.2). This PR updates suppaftp to 12.0 and, while running the new audit pipeline, also clears the quick-xml advisories (RUSTSEC-2026-0194, RUSTSEC-2026-0195) via rusty-s3 0.10 (which dropped quick-xml) and quick-xml 0.41.

Changes

• suppaftp 7.0 -> 12.0. API used by oneio (FtpStream::connect, login, transfer_type, retr_as_stream, FtpError) is source-compatible; no code changes needed for the FTP path.
• Feature wiring: suppaftp?/rustls -> suppaftp?/rustls-aws-lc-rs (feature renamed in suppaftp 10+).
• MSRV declared as rust-version = "1.88.0" (suppaftp 12 requires Rust 1.88).
• rusty-s3 0.9 -> 0.10: parse_response now takes &str instead of &[u8]; two call sites in src/s3/mod.rs updated.
• quick-xml 0.38 -> 0.41; existing usage compiles unchanged.
• CI: new Check MSRV job (cargo msrv verify -- --all-features) in rust.yml, and a new Security audit workflow (cargo audit, on Cargo.toml/Cargo.lock changes and weekly).
• New ignored integration test tests/ftp_tests.rs against ftp.radb.net (the same host bgpkit-commons IRR sources use) for manual FTP-path verification.

Testing

• cargo +1.88.0 check --all-features and --no-default-features pass (fresh lockfile resolution).
• cargo clippy --all-features -- -D warnings and --no-default-features pass; cargo fmt --check passes.
• cargo test --all-features passes (S3/R2 tests stay ignored as usual).
• cargo audit reports 0 vulnerabilities (307 crates scanned).
• Real FTP check: cargo test --test ftp_tests --features ftp -- --ignored against ftp.radb.net passes (anonymous login + binary RETR + gzip decode of radb.db.gz).
• S3 integration tests remain covered by the existing test-s3 CI job (requires R2 credentials).

[Copilot]

🟡 Changes recommended

The MSRV workflow passes an invalid custom command and will fail before checking the crate.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates vulnerable FTP/XML dependencies and adds security/MSRV validation.

Changes:

• Upgrades suppaftp, rusty-s3, and quick-xml.
• Adapts S3 response parsing and adds an FTP integration test.
• Adds MSRV and dependency-audit workflows.

File summaries

File	Description
Cargo.toml	Updates dependencies, features, and MSRV.
src/s3/mod.rs	Adapts rusty-s3 parsing calls.
tests/ftp_tests.rs	Adds manual FTP verification.
.github/workflows/rust.yml	Adds MSRV validation.
.github/workflows/audit.yml	Adds scheduled security auditing.
CHANGELOG.md	Documents security and CI changes.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

The new Rust 1.88 MSRV conflicts with the documented Rust 1.70 MSRV in AGENTS.md.

Review details

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

Cargo.toml:6

• The MSRV declaration now conflicts with the contributor guidance in AGENTS.md:94, which still says the project supports Rust 1.70+. Update that guidance to 1.88 so future changes and local verification do not target an unsupported compiler.

• Files reviewed: 6/6 changed files
• Comments generated: 0 new
• Review effort level: Balanced