fix: bump pyo3 to 0.29 and run cargo update for RUSTSEC-2026-0176/0177

[seant-aws]

What was the problem/requirement? (What/Why)

cargo deny check advisories fails due to two security vulnerabilities in pyo3 0.28.3:

• RUSTSEC-2026-0176: Out-of-bounds read in nth/nth_back for PyList and PyTuple iterators
• RUSTSEC-2026-0177: Missing Sync bound on PyCFunction::new_closure closures

This blocks the release pipeline.

What was the solution? (How)

Bumped pyo3 from 0.28 to 0.29 in rust-bindings/Cargo.toml and ran cargo update to regenerate Cargo.lock. Regenerated THIRD-PARTY-LICENSES.txt to reflect the updated dependency tree.

What is the impact of this change?

No functional changes. pyo3 0.29 is API-compatible for our usage (confirmed by clean cargo build). Transitive dependencies received minor/patch bumps via cargo update.

target-lexicon was incorrectly included in the previous version of this file — it's a build-only dependency (filtered by ignore-build-dependencies = true in about.toml) and doesn't ship in the distributed wheel.

How was this change tested?

• cargo build passes in rust-bindings/
• Unit tests (CI will run rust_quality.yml and code_quality.yml)

Was this change documented?

N/A — dependency version bump only.

Is this a breaking change?

No.

Does this change impact security?

Yes — it resolves two security advisories (RUSTSEC-2026-0176, RUSTSEC-2026-0177). No new threat surface introduced.