Bump deps to v0.3.1: security fixes + cargo install fix

[gogoout]

Summary

• Fixes cargo install sshfwd — russh 0.57 used caret ranges on RustCrypto pre-releases, causing cargo's resolver to land on rsa-0.10.0-rc.12 (type-mismatch compile error). russh 0.60 uses exact pins (rsa =0.10.0-rc.16, pkcs8 =0.11.0-rc.11), so the resolver is now deterministic and correct.
• Closes 9 of 10 Dependabot security alerts (all high-severity ones):
  • russh DoS GHSA-f5v4-2wr6-hqmg (fixed in 0.60.1) — russh 0.57 → 0.60
  • aws-lc-sys 5× high CVEs (fixed in 0.38–0.39) — 0.37.0 → 0.40.0 via cargo update
  • libcrux-sha3 high GHSA-q29p-9pfr-j652 — libcrux-ml-kem dropped entirely in russh 0.60
  • lru low GHSA-rhfx-m35p-ff5j — 0.12.5 → 0.16.4 via ratatui 0.30 transitive bump
  • rand low GHSA-cq8v-f236-94qc — 0.9.2 → 0.10.1 via cargo update ✅ (fully closed)
• Supersedes PR build(deps): Bump aws-lc-sys from 0.37.0 to 0.37.1 in the cargo group across 1 directory #16 (aws-lc-sys 0.37.0 → 0.37.1) — that bump did not satisfy any of the open CVEs (required ≥0.38.0); close it after this merges.
• ratatui 0.29 → 0.30, crossterm 0.28 → 0.29, ssh2-config 0.6 → 0.7 (all latest)
• One code change: authenticate_publickey_with in ssh/session.rs — russh 0.60 changed AgentIdentity from a plain PublicKey to an enum; extract via .public_key().into_owned()

Test plan

• cargo fmt -- --check passes
• cargo clippy --all-targets --all-features passes
• cargo test --workspace passes (19 tests)
• cargo build -p sshfwd succeeds
• cargo install --path crates/sshfwd --force succeeds (verifies resolver fix)
• After merging: tag v0.3.1 and push to trigger GH Actions release; close PR build(deps): Bump aws-lc-sys from 0.37.0 to 0.37.1 in the cargo group across 1 directory #16