chore(deps): align with the VTA on main — vta-sdk 0.35, trust-tasks 0.19.4

[stormer78]

The plugin resolved trust-tasks-rs 0.17.3 / vta-sdk 0.31, two
generations behind the VTA it stores memories in. Two response shapes had
moved underneath it, both fatal at the client rather than refused by the
agent, because every generated response type is
#[serde(deny_unknown_fields)]:

• auth/whoami/0.1 gained a REQUIRED capabilities member in 0.18.
• provision/integration/0.3's ProvisionSummary gained adminScope
  and context.

A VTA built from main emits all three unconditionally, so enrolment and
every session check fail on a reply that is entirely well-formed.

Most of this is the lockfile rather than the manifests. vti-secrets was
pinned at 0.3.0 though the requirement already admitted 0.3.4, and it
dragged vti-common 0.15 -> vta-sdk 0.31 -> tdk 0.10 in beside the
new set, which is the two-node trust-tasks-rs graph that fails on
expected MediatorAcl, found a different MediatorAcl. affinidi-tsp was
likewise stale at 0.1.14, which does not carry the advertises_tsp that
affinidi-messaging-sdk 0.23 calls.

vta-sdk 0.31 -> 0.35
vti-common 0.15.0 -> 0.18.2 (lock)
vti-secrets 0.3.0 -> 0.3.4 (lock)
affinidi-tsp 0.1.14 -> 0.1.16 (lock)
trust-tasks-rs 0.17.3 -> 0.19.4 (transitive)
affinidi-tdk 0.10 -> 0.13 (transitive)

One source change: CreateAclRequest gained capabilities, the ACL
narrowing member. It is set empty, which leaves the entry holding
everything AGENT_ROLE implies — exactly what it held before the member
existed. Narrowing it to what this plugin actually exercises is worth
doing and is deliberately not done here: it changes the grant, not the
pin.

Lockfile holds exactly one node of each. 95/95 tests pass, clippy clean.