chore(deps): move serde-saphyr to 1.1 and refresh the lock

serde-saphyr was the one entry that could not move on its own. Cargo
treats every 0.0.z as its own breaking version, so "0.0.28" was an exact
pin while every other requirement in the table already permitted newer
releases. Bumping it to "1.1" is the only manifest edit; the remaining
twelve crates in the lock diff needed no change to their floors.

The 1.x API surface Bear uses is unchanged: from_str, from_reader,
to_string, and Error, across crates/bear/src/config and the build-time
codegen in build-support/compilers-codegen. The release also sheds a
wasm-bindgen and ahash subtree, taking the workspace from 135 packages
to 127.

Refreshing the lock also clears RUSTSEC-2026-0204, a null-pointer
dereference in crossbeam-epoch fixed in 0.9.20; the lock carried 0.9.18.
It reaches Bear only through assert_fs in the integration-test
dev-dependencies, so no shipped binary was exposed. CI did not catch it
because the security-audit job is gated to master and never runs on an
rc branch.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: rizsotto