deps: clear the Dependabot alerts that need no major bump

[eigmax]

Summary

Clears the Dependabot alerts that need no major-version bump, and removes a private repository's name from a public comment.

• Rust: rand 0.8.5 → 0.8.6 (GHSA-cq8v-f236-94qc) in both lockfiles; in examples/, openssl 0.10.77 → 0.10.81 (GHSA-phqj-4mhp-q6mq, GHSA-xv59-967r-8726 and others) and serde_with 3.18 → 3.22 (GHSA-7gcf-g7xr-8hxj). The guest programs build from their own lockfiles, so no guest ELF or verifying key changes.
• Go (gnark-ffi): golang.org/x/crypto 0.35.0 → 0.52.0, which clears the ssh/agent advisories. It is an indirect dependency; only blake2b is imported. v0.52 requires Go 1.25, so go.mod moves to go 1.25.0 / toolchain go1.25.4; with the default GOTOOLCHAIN=auto an older local Go downloads it.
• Cargo.toml: the Plonky3 pin comment no longer names a private repository.

Not in this PR: the remaining Rust alerts need major bumps, mostly through ethers 2 → reqwest 0.11 (hickory-proto, jsonwebtoken, rustls-webpki 0.101, ring 0.16), plus lru, git2 and tracing-subscriber 0.2; rsa has no fix. The Plonky3 challenger advisory is handled separately because it changes the wrap verifying key.

Test plan

• CI test job on the self-hosted box: fmt, clippy (workspace and ark), the twelve-package cargo test -r loop (including zkm-recursion-gnark-ffi built with Go 1.25.4), zkm-picus, zkm-core-machine cost and Weierstrass tests, verifier malformed-input tests under both feature sets — all passed.