chore(deny): ignore RUSTSEC-2026-0192 (ttf-parser unmaintained, transitive via winit)

The "Cargo Deny Check" CI gate went red on the advisories pass with
RUSTSEC-2026-0192 — `ttf-parser` flagged unmaintained. This is an informational
"unmaintained" advisory, NOT an exploitable vulnerability, on a purely
transitive dependency the workspace cannot influence from its manifest:

    winit 0.30.13 -> sctk-adwaita -> ab_glyph -> owned_ttf_parser -> ttf-parser 0.25.1

ttf-parser 0.25.1 is already the latest release; the only way off it is for
winit's Wayland client-side-decoration stack to drop ab_glyph, which is outside
our control until a future winit bump. Crucially this is NOT introduced by the
egui 0.34->0.35 bump in this PR: `main` carries the identical `ttf-parser
0.25.1`, and cargo-deny fetches the live RUSTSEC database at check time, so the
freshly-published advisory fails equally on `main` — this PR is simply the first
to re-run the security workflow (which is path-filtered to Cargo.toml/lock
changes) after the advisory landed.

Per deny.toml's own stated policy ("a real transitive advisory with no safe
upgrade"), added RUSTSEC-2026-0192 to the `[advisories].ignore` list with a
comprehensive comment recording the dependency chain, why it is safe (unmaintained
!= vulnerable), and the revisit condition (a winit bump that drops the
ab_glyph/ttf-parser chain). `bans`/`licenses`/`sources` were already green and are
unaffected; no real vulnerability is being suppressed.

Verified locally: `cargo deny check` -> "advisories ok, bans ok, licenses ok,
sources ok".

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: doublegate

deny.toml

@@ -6,11 +6,24 @@ version = 2
 db-path = "~/.cargo/advisory-db"
 db-urls = ["https://github.com/rustsec/advisory-db"]
 yanked = "deny"
-# No advisory ignores: the prior RUSTSEC-2024-0436 (`paste`, via the old wgpu
-# Metal backend) entry was dropped once the wgpu 29 / naga 29 bump removed
-# `metal` (and thus `paste`) from the tree. Keep this list empty unless a real
-# transitive advisory with no safe upgrade reappears.
-ignore = []
+# The prior RUSTSEC-2024-0436 (`paste`, via the old wgpu Metal backend) entry was
+# dropped once the wgpu 29 / naga 29 bump removed `metal` (and thus `paste`) from
+# the tree. Keep this list minimal — only "unmaintained"/"unsound" informational
+# advisories on transitive deps with no safe upgrade; never suppress a real
+# exploitable vulnerability.
+ignore = [
+    # `ttf-parser` unmaintained. NOT a vulnerability — an informational
+    # "unmaintained" advisory. It is a pure transitive dep of `winit` (which the
+    # workspace pins at 0.30.13) via its Wayland client-side-decoration font
+    # stack: winit -> sctk-adwaita -> ab_glyph -> owned_ttf_parser -> ttf-parser
+    # 0.25.1 (already the latest release). There is no safe upgrade until winit's
+    # decoration stack moves off ab_glyph, so this cannot be resolved from our
+    # manifest. Surfaced first by the egui-0.35 PR only because it is the first
+    # PR to re-run the security workflow after the advisory was published; `main`
+    # carries the identical `ttf-parser 0.25.1` and is affected equally. Revisit
+    # when a future winit bump drops the ab_glyph/ttf-parser chain.
+    "RUSTSEC-2026-0192",
+]
 
 [licenses]
 version = 2