Fix remaining Dependabot alerts: hickory-proto (#62), rand (#54), lru (#44)

[erubboli]

Stacked on #2111 (which carries the rustls/chacha20 and tokio-postgres/postgres-protocol lockfile fixes needed for cargo-deny/cargo-vet to pass).

Fixes the three remaining open Dependabot alerts, each requiring a code migration rather than a lockfile bump:

#62 (medium) — hickory-proto: O(n²) name compression CPU exhaustion (RUSTSEC-2026-0119)

Patched only in 0.26.1+. Migrates dns-server from hickory-client/server 0.24 → hickory-proto/server 0.26.3:

• hickory-client no longer exists in the 0.26 family; its rr types moved to hickory-proto
• the Authority trait was replaced by ZoneHandler (search/lookup signatures changed, LookupControlFlow returns, is_axfr_allowed → axfr_policy, InMemoryAuthority → InMemoryZoneHandler, ServerFuture → Server)
• dynamic DNS updates remain rejected (the ZoneHandler::update default responds NotImplemented, now documented)
• all 26 dns-server tests pass unchanged in their assertions

#54 (low) — rand 0.7.3 unsoundness (RUSTSEC-2026-0097)

rand 0.7.3 was pulled by probabilistic-collections 0.7.0, which is abandoned (last release 2020) and has no patched 0.7.x. Replaced with an in-house bloom filter in utils (same wrapper API: randomized SipHash-1-3 keys via siphasher, optimal m/k sizing, Kirsch-Mitzenmacher-style indexing). Removes probabilistic-collections and rand 0.7 from the tree entirely. Added unit tests (no false negatives, false-positive-rate bounds, clear, randomized keys).

#44 (low) — lru 0.12.5 Stacked Borrows violation (RUSTSEC-2026-0002)

Patched only in lru 0.16.3, but every upstream iced release (up to 0.14/master) still pins lru 0.12 via the glyphon text stack (iced master replaced it with unreleased cryoglyph). Created mintlayer/iced-glyphon — a fork of iced_glyphon 0.6.0 whose only change is the lru 0.12.1 → 0.16.3 dependency bump (verified compile-compatible, no source changes) — consumed via [patch.crates-io] with a pinned rev. Drop the patch once iced ships a fixed release.

Supply-chain

• refreshed imports.lock, added policy.iced_glyphon (audit-as-crates-io = true) and exemptions for the newly introduced versions (hickory 0.26 family, lru 0.16.4, jni 0.22 stack, etc.); 7 initially-added exemptions turned out to be unnecessary after the imports refresh and were pruned

Verification

• full ./do_checks.sh (fmt, cargo-deny, cargo-vet, clippy, codecheck, wasm-doc) green locally under the CI toolchain (1.92.0)
• cargo test -p utils -p dns-server -p p2p: 42 + 26 + 314 tests pass
• node-gui compiles against the patched iced_glyphon
• two rounds of local AI code review (open-code-review CLI, glm-5.3-flash) run on the diff before pushing; all findings addressed