crates: bump blake2 and sha2 to 0.11 together

[ifaouibadi]

Summary

• Bumps blake2 and sha2 together in crates/Cargo.toml, 0.10 → 0.11. Both now pull digest 0.11.3, closing the split that made ae-core/src/hash.rs's Digest::new() calls resolve against two different digest majors (Blake2b against 0.11's trait, Sha256 against 0.10's) — the reason the two prior single-crate Dependabot PRs (blake2 alone, filed against bindings/dart/rust and bindings/wasm-js/core-component) weren't mergeable.
• No source change was needed in hash.rs: blake2 0.11 and sha2 0.11 keep the same Digest::new/update/finalize surface and the same Blake2b<U32> / digest::consts::U32 paths, so unifying the digest version was the whole fix.
• Regenerates all four tracked lockfiles in this one commit — crates/Cargo.lock, bindings/python/Cargo.lock, bindings/dart/rust/Cargo.lock, bindings/wasm-js/core-component/Cargo.lock — each via a scoped cargo check/cargo build update (not a full cargo generate-lockfile), so only the digest/blake2/sha2 dependency chain moved; no unrelated package bumped. Side effect: this also collapses a pre-existing duplicate-digest diamond (0.10.7 + 0.11.3 both present before this change, now a single 0.11.3 in crates/ and bindings/python; bindings/dart/rust still carries a separate digest 0.10.7 for flutter_rust_bridge's own md-5 dependency, untouched and out of scope).

Verification

All commands run locally against this branch, crates/ unless noted:

• cargo fmt --all -- --check — clean.
• cargo clippy --locked --all-targets -- -D warnings — clean.
• cargo test --locked — all green, including hash::tests::blake2b_256_matches_the_published_vector and hash::tests::sha256_matches_the_published_vector (published test vectors, unchanged output).
• cargo run --locked -p ae-parity -- matrix then git diff --exit-code -- ae-parity/MATRIX.md ae-parity/matrix.json — no diff: the full corpus reproduces byte-identical, matching parity.yml's own gate.
• Each binding built --locked from the regenerated lockfile: bindings/python (cargo build --locked), bindings/dart/rust (cargo build --locked), bindings/wasm-js/core-component (cargo component build --release --target wasm32-unknown-unknown, the same cargo-component@0.21.1 pin wasm-bindings.yml installs) — all clean.

Note for review

blake2 0.11.0 and sha2 0.11.0 declare rust-version = "1.85"; the workspace's own rust-version = "1.82" (crates/Cargo.toml) is now understated by that. Every CI job pins the toolchain to 1.97.1 (crates/rust-toolchain.toml), so nothing gates red on this — flagging only because the declared MSRV field is no longer accurate, and left the field untouched since correcting it wasn't part of the row's stated shape.

[github-actions]

Thanks for the pull request — it is in the queue and a maintainer will review it.

This repository is maintained on a weekly cadence. Anything opened from outside gets
a human reply within 2 business days; this comment is automation confirming your
pull request landed, and it is not that reply.

What happens next:

• CI runs on the pull request. Check, Build and Test need to be green before
  review — you can push fixes straight to the same branch.
• A maintainer reviews it against CONTRIBUTING.md.
• A change to a package's public API, or a new dependency, needs a maintainer
  decision before it can merge. That is where the call gets made rather than a
  delay, and we will tell you either way instead of leaving it open.

If this is a security fix for an unreported vulnerability, please close it and use
the private channel first — SECURITY.md.
A public pull request describes the flaw to everyone before the fix is released.