chore: Fix CI failures from upstream-inherited workflow

[imthaghost]

Summary

Three CI checks were failing on main after the test-coverage merge. Each is fixed here.

• Cargo Format — applied nightly rustfmt rules (imports_granularity = "Crate", trailing commas in match arms) to mailbox/src/{server,state,postgres_store}.rs and transit/src/{main,server}.rs.
• Cargo deny — bumped rand 0.8.5 → 0.8.6 (fixes RUSTSEC ThreadRng UB advisory) and ignored three rustls-webpki 0.101.7 advisories with a documented reason. The webpki chain comes from async-tungstenite -> async-tls -> rustls 0.21 and is not reachable from our code paths (servers terminate TLS at a reverse proxy; client TLS is opt-in via the tls/native-tls features). Will resolve naturally when async-tungstenite upgrades.
• SemVer — dropped the job. cargo-semver-checks was comparing our blackhole 0.8.0 library against an unrelated blackhole 0.8.0 squatter on crates.io (the failures cite Blackhole struct, get_online_processors macro, etc. — none of which exist in our codebase). We don't publish to crates.io as blackhole, so the check has no value.

Test plan

• cargo build --workspace — green
• cargo test -p blackhole-mailbox -p blackhole-transit — 32 + 7 tests, all green
• CI on the PR: Cargo Format, Cargo deny, Clippy, Coverage, Dist (Linux/Windows/macOS) should now pass; SemVer is gone

Notes

• The advisory ignores are documented in deny.toml so future readers understand why each is suppressed
• Vouch workflow will still fail at the app-token step until the GitHub App is provisioned (deferred setup, tracked in CLAUDE.md)