fix(deps): resolve Dependabot security alerts

[Xyhlon]

Summary

• update the dependency graph to patched releases for all currently fixable Dependabot alerts, including russh 0.62.3, git2 0.20.4, bytes 1.12.1, rand 0.8.7, rsa 0.10.0-rc.18, and keccak 0.1.6
• replace unmaintained serde_yml/libyml with serde_yaml_ng and remove the Rust age test dependency that introduced RUSTSEC-2026-0173 through proc-macro-error2
• use a deterministic test-only age fixture, keeping age key generation outside the Rust dependency graph
• migrate the NixOS test harness to the current nixpkgs API and retain OpenSSL in the packaged binary runtime closure
• pin ssh2 0.9.5/libssh2-sys 0.3.1 and cap accepted SSH tunnels at 32 so overload cannot create an unbounded task/file-descriptor backlog
• reject missing or malformed TOTP credentials without panicking when a server offers keyboard-interactive fallback
• strengthen the performance test with service-survival checks after each 200-client load phase
• build every flake check explicitly in CI, then evaluate the aggregate flake check without rebuilding the NixOS VM suites concurrently

Verification

• cargo fmt --all -- --check
• cargo check --all-targets
• cargo clippy --all-targets -- --deny warnings
• cargo test --lib (permit reclamation plus missing/malformed TOTP regression cases)
• cargo test --test integration_test test_second_server_wrong_credentials -- --exact
• cargo deny check advisories bans licenses sources
• nix build -L .#checks.x86_64-linux.simple --show-trace
• nix build -L .#checks.x86_64-linux.cli --show-trace
• nix build -L .#checks.x86_64-linux.performance --show-trace
• forced a second clean performance VM run before the review follow-up with nix build -L --rebuild .#checks.x86_64-linux.performance
• nix build -L .#checks.x86_64-linux.sshbind-nextest .#checks.x86_64-linux.sshbind-toml-fmt --show-trace
• nix flake check --no-build -L --show-trace