fix(deps): bump pulldown-cmark to 0.13.5 for RUSTSEC-2026-0414 (#8644)

## Summary

Bumps `pulldown-cmark` 0.13.4 → 0.13.5 in `Cargo.lock` to clear
[RUSTSEC-2026-0414](https://rustsec.org/advisories/RUSTSEC-2026-0414),
which `cargo-deny` started flagging this morning. The advisory landed in
the RustSec database at 08:50 UTC on 2026-10-28; main's last Security
run passed at 00:24 UTC, and every PR touching a Rust path since (e.g.
#8613, `jitter/block-staging-relay-domain`) fails the required
**Security** check on it. Main will go red on its next Rust-path push
until this merges.

## Exposure

Not exploitable in Buzz: the advisory requires
`Options::ENABLE_WIKILINKS`, which is off by default. The relay's only
use is `render_policy_document` in
`crates/buzz-relay/src/api/invites.rs`, which parses operator-authored
policy Markdown via `Parser::new` with default options. This is a
dependency-policy fix.

## Change

- `cargo update -p pulldown-cmark --precise 0.13.5` under the pinned
1.98.1 toolchain; `crates/buzz-relay/Cargo.toml` already requires
`0.13.4` (`^0.13.4`), so no manifest edit.
- The same re-resolution moved `data-encoding-macro-internal`'s `syn`
edge from 2.0.117 to the 1.0.109 already in the lock (declared
requirement `>=1, <3`). No crate is added or removed.
- `desktop/src-tauri/Cargo.lock` does not contain `pulldown-cmark`, and
`cargo-deny` only checks the root workspace.

Not touched here: `deny.toml:50`'s `RUSTSEC-2026-0381` ignore now warns
`advisory-not-detected` (the crate is gone). Harmless; can be removed
separately.

## Verification

- `cargo update --dry-run` showed `pulldown-cmark` as the only version
change before applying.
- CI's Security lane on this PR is the real check.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Signed-off-by: Matt Toohey <contact@matttoohey.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

Cargo.lock

@@ -2597,7 +2597,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccc2776f0c61eca1ca32528f85548abd1a4be8fb53d1b21c013e4f18da1e7090"
 dependencies = [
  "data-encoding",
- "syn 2.0.117",
+ "syn 1.0.109",
 ]
 
 [[package]]
@@ -7958,9 +7958,9 @@ dependencies = [
 
 [[package]]
 name = "pulldown-cmark"
-version = "0.13.4"
+version = "0.13.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9f068eba8e7071c5f9511831b44f32c740d5adf574e990f946ddb53db2f314e"
+checksum = "278e9268c93b9e498a2da46c34d90ba93a3255eb99009646398f34bc73ab36eb"
 dependencies = [
  "bitflags 2.13.0",
  "memchr",