fix(deps): bump ctutils to 0.4.5 for RUSTSEC-2026-0385 (#8560)

🤖
## Summary
On 2026-10-23, RustSec published RUSTSEC-2026-0385 against `ctutils`, a
constant-time helper crate used by the RustCrypto hashing and HMAC
crates. Some of its functions were meant to run in constant time, so
their timing would reveal nothing about secret values, but in versions
before 0.4.4 they could compile to code that branches on those values.
Since the advisory came out, `cargo-deny check` reports advisories as
failed. That breaks `Security Domain / Security` on `main` and on every
PR that runs the Rust security job.

This PR changes `ctutils` from 0.4.2 to 0.4.5 in the three lockfiles
that pin it: `Cargo.lock`, `desktop/src-tauri/Cargo.lock`, and the
`buzz-feature-flags` relay-feature-selection test fixture. No other
packages change.

| Advisory | Crate | Change |
|---|---|---|
| [RUSTSEC-2026-0385](https://rustsec.org/advisories/RUSTSEC-2026-0385)
| `ctutils` (non-constant-time mask generation and `u128` comparisons) |
0.4.2 → 0.4.5 |

### Related issue
N/A. I searched open and closed PRs for `ctutils` and
`RUSTSEC-2026-0385` and found none.

### Testing
- `cargo deny check advisories`: `advisories ok`. On `origin/main` the
Security job fails on this advisory.
- `cargo check --workspace` passes.
- `cargo test -p buzz-feature-flags --test
relay_feature_selection_contract` passes. This test compiles the fixture
with `--locked`.
- The pre-push hook's Rust and Tauri lanes pass.

Signed-off-by: Logan Johnson <loganj@squareup.com>
Co-authored-by: Larry <627498bd4bd1f281a16431e3c6cce3b5c25b6692798c78672298aefbf2f8f8b5@buzz.block.builderlab.xyz>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Cargo.lock

@@ -2396,9 +2396,9 @@ dependencies = [
 
 [[package]]
 name = "ctutils"
-version = "0.4.2"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+checksum = "38d28fb6aa7dd680b3ffd1a3e64e115c177bdba63c0ae7f9cd48129ff05c4fa0"
 dependencies = [
  "cmov",
 ]

crates/buzz-feature-flags/tests/fixtures/relay-feature-selection/Cargo.lock

@@ -450,9 +450,9 @@ dependencies = [
 
 [[package]]
 name = "ctutils"
-version = "0.4.2"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+checksum = "38d28fb6aa7dd680b3ffd1a3e64e115c177bdba63c0ae7f9cd48129ff05c4fa0"
 dependencies = [
  "cmov",
 ]

desktop/src-tauri/Cargo.lock

@@ -2198,9 +2198,9 @@ dependencies = [
 
 [[package]]
 name = "ctutils"
-version = "0.4.2"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+checksum = "38d28fb6aa7dd680b3ffd1a3e64e115c177bdba63c0ae7f9cd48129ff05c4fa0"
 dependencies = [
  "cmov",
 ]