CI: Address Zizmor warnings and bump dep versions

[Saul-STFC]

What this changes

This PR adds a 7 day cooldown for version bumps as suggested by zizmor and also bumps dep version hashes

Spec basis

Checklist

• pre-commit run --all-files passes — this is the single source of truth for what must pass.
• CHANGELOG.md has an entry under ## [Unreleased], if this is user-facing. Any change to a public type, trait method or exported FFI contract counts, since driver crates consume them.
• Doc comments on any FFI function touched list every SQLSTATE from its spec diagnostics table, saying for each whether the driver returns it or why not.
• New tests were checked by breaking the line they cover and watching them fail. A test that cannot fail reports coverage that does not exist.

If it applies

• Miri, for anything touching raw pointers: MIRIFLAGS="-Zmiri-disable-isolation" cargo +nightly miri test -p stackable-odbc-core --lib -- --skip proptest
• loom, for anything touching handle locking: RUSTFLAGS="--cfg loom" cargo test --lib loom_tests
• Breaking changes for driver crates are called out above, so the drivers can be updated alongside.

Notes for the reviewer