update semver compat. deps, fix cbindgen CI diff check

[cpu]

Notably fixes two dev-dep RUSTSEC issues:

• GHSA-pg9f-39pc-qf8g for crossbeam-channel
• GHSA-rr8g-9fpq-6wmg for tokio

Along the way I also dug into the main CI failure that's been flagging a cbindgen diff for the rustls.h header. I believe this is an upstream regression and so to fix it we have to temporarily pin our nightly version. I've opened an upstream issue for this (rust-lang/rust#139715).

[cpu]

wip: try pinning nightly rust?

This seems to have done the trick, but is an unsatisfying solution.

[djc]

Where do the guards come from? Is that related to the nightly somehow? Maybe there is a bug in a specific nightly? I agree that pinning the nightly is unsatisfying if we don't understand why it helps but in general pinning nightly seems like a good way to make CI more deterministic.

[cpu]

Where do the guards come from? Is that related to the nightly somehow?

The guards come from mapping cargo features to #define's. That in turn relies on expanding the crate content with specific features enabled. It's controlled in the cbindgen.toml file:

rustls-ffi/librustls/cbindgen.toml

Lines 13 to 21 in 4d1d5d8

	[defines]
	"feature = read_buf" = "DEFINE_READ_BUF"
	"feature = aws-lc-rs" = "DEFINE_AWS_LC_RS"
	"feature = ring" = "DEFINE_RING"
	"feature = fips" = "DEFINE_FIPS"
	[parse.expand]
	crates = ["rustls-ffi"]
	features = ["read_buf", "aws-lc-rs", "ring", "fips"]

The parse.expand part requires nightly: mozilla/cbindgen#1015 We require the parse.expand part because of the macro we use for the numeric enums since #322

[cpu]

cpu marked this pull request as ready for review now

I think this is good to go. I've opened an upstream issue for what I believe is the nightly regression that broke our workflow. Depending on how that's triaged we can revisit the change here.

[djc]

Pretty sure loom is not supposed to be a lib dependency. IIRC most users guard with a cfg flag.

[cpu]

cargo tree | grep loom and cargo tree --invert loom both produce no results. I assume this is something transitive and not our issue?

[cpu]

It looks like it's hickory-resolver -> moka -> loom ?

[cpu]

moka-rs/moka#501