fix(deps): bump publicsuffix to 2.3 to drop vulnerable idna 0.2.3

[AlfioEmanueleFresta]

Fixes Dependabot alert #25 (CVE-2024-12224 / GHSA-h97m-ww89-6jmq / RUSTSEC-2024-0421).

What

publicsuffix = "1.5" transitively pulls idna 0.2.3, which accepts Punycode labels that decode to no non-ASCII output. That allows example.org and xn--example-.org to compare equal after IDNA normalisation, which is unsafe when host comparison is part of a privilege check.

publicsuffix 2.3 depends on idna ^1.0 (patched). After this bump the only idna in Cargo.lock is 1.1.0.

API adjustments

publicsuffix 2.x is a different crate API. The change is contained to libwebauthn/src/ops/webauthn/psl.rs:

• List::from_str(&data) -> data.parse::<List>().
• list.parse_domain(host).ok()?.root() -> Psl::domain(host.as_bytes()) returning the registrable domain directly.
• domain.suffix() -> Psl::suffix(host.as_bytes()).

Suffix::is_known() filter

publicsuffix 2.x applies an implicit-wildcard rule that treats any unlisted label as its own public suffix. With the system PSL .dat, that means:

• v1: public_suffix("localhost") = None, public_suffix("sub.localhost") = None
• v2 raw: public_suffix("localhost") = Some("localhost") (with Suffix::is_known() == false)

If we surface the implicit-wildcard suffix through the PublicSuffixList trait, is_registrable_domain_suffix_or_equal("localhost", "sub.localhost", ...) would reject localhost rp.ids (added in da9c709). The new impl filters on Suffix::is_known() so only PSL-listed suffixes flow through, preserving v1 semantics.

Smoke-tested against /usr/share/publicsuffix/public_suffix_list.dat:

host	suffix (raw)	is_known	wrapper public_suffix	wrapper registrable_domain
example.com	com	true	Some("com")	Some("example.com")
login.example.com	com	true	Some("com")	Some("example.com")
com	com	true	Some("com")	None
co.uk	co.uk	true	Some("co.uk")	None
bbc.co.uk	co.uk	true	Some("co.uk")	Some("bbc.co.uk")
localhost	localhost	false	None	None
sub.localhost	localhost	false	None	None

Test plan

• cargo build --workspace --all-targets --all-features
• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace (171 unit + integration tests pass)
• cargo publish --dry-run -p libwebauthn
• cargo tree -i idna shows only idna 1.1.0; idna 0.2.3 is gone