Bump pulldown-cmark to 0.13.5 for RUSTSEC-2026-0414 #110

Problem

cargo deny check advisories fails on every PR that touches Cargo files because of RUSTSEC-2026-0414 in pulldown-cmark 0.13.4: with ENABLE_WIKILINKS, crafted input makes the parser emit an exponential number of events.

LowNotes enables Options::ENABLE_WIKILINKS in src-tauri/src/references.rs and parses note content that can arrive from paired peers, so a malicious or corrupted note could stall the reference indexer.

Fix

Raise pulldown-cmark to 0.13.5 (keeping default-features = false) and move only that crate in src-tauri/Cargo.lock. No code changes.

Dependabot's grouped PR #96 also carries this bump, but bundles five other crates; this issue tracks the security fix on its own so it can land first.