chore(vet): import the zcash and isrg audit sets; record the SQLCipher crypto deps

SQLCipher brings six third-party RustCrypto crates into the graph. New crates
entering the graph are a supply-chain decision, not the version-churn
bookkeeping that a cache refresh covers, so this takes the strongest mechanism
that applies before falling back to a weaker one.

Imported two more aggregate audit sets rather than exempting everything:

  [imports.zcash]  https://raw.githubusercontent.com/zcash/rust-ecosystem/...
  [imports.isrg]   https://raw.githubusercontent.com/divviup/libprio-rs/...

That is not paperwork. Exemptions drop 117 -> 103: SIXTEEN crates move from
"nobody read this" to genuinely audited, including hmac and inout -- two of the
six SQLCipher deps -- plus serde, sha2, subtle, getrandom, zlib-rs and others
that were exempted before this PR.

Four remain unaudited by us and by every imported set, and are exempted with a
note saying exactly that: aes 0.8.4, block-padding 0.3.3, cbc 0.1.2,
pbkdf2 0.12.2. The fleet rule forbids hand-rolled crypto and requires an
audited ecosystem crate, so these are the correct dependencies; the exemption
records that nobody has read these versions, which is true.

aes and pbkdf2 were already exempted, but at criteria safe-to-run -- enough
while they entered only through `zip` on dev/test paths. SQLCipher decryption
puts them on the SHIPPED path, so both are raised to safe-to-deploy. The gate
surfacing that change of exposure is the gate working.

No certify, no --accept-all.

Gate proven able to fail, with a well-formed mutation: re-pointing the cbc
exemption to a version that does not exist gives exit 255 and
`cbc:0.1.2 missing ["safe-to-deploy"]`; restoring it gives exit 0. (A first
attempt that deleted the block outright only proved the store formatter works
-- vet complained about blank lines, not about coverage.)

Author: h4x0r

supply-chain/config.toml

@@ -13,9 +13,15 @@ url = "https://raw.githubusercontent.com/EmbarkStudios/rust-ecosystem/main/audit
 [imports.google]
 url = "https://raw.githubusercontent.com/google/rust-crate-audits/main/audits.toml"
 
+[imports.isrg]
+url = "https://raw.githubusercontent.com/divviup/libprio-rs/main/supply-chain/audits.toml"
+
 [imports.mozilla]
 url = "https://raw.githubusercontent.com/mozilla/supply-chain/main/audits.toml"
 
+[imports.zcash]
+url = "https://raw.githubusercontent.com/zcash/rust-ecosystem/main/supply-chain/audits.toml"
+
 [policy.sqlite-core]
 audit-as-crates-io = false
 
@@ -27,7 +33,7 @@ audit-as-crates-io = false
 
 [[exemptions.aes]]
 version = "0.8.4"
-criteria = "safe-to-run"
+criteria = "safe-to-deploy"
 
 [[exemptions.aho-corasick]]
 version = "1.1.4"
@@ -65,8 +71,8 @@ criteria = "safe-to-deploy"
 version = "2.13.0"
 criteria = "safe-to-deploy"
 
-[[exemptions.block-buffer]]
-version = "0.10.4"
+[[exemptions.block-padding]]
+version = "0.3.3"
 criteria = "safe-to-deploy"
 
 [[exemptions.bytemuck]]
@@ -85,14 +91,14 @@ criteria = "safe-to-run"
 version = "0.35.0"
 criteria = "safe-to-run"
 
+[[exemptions.cbc]]
+version = "0.1.2"
+criteria = "safe-to-deploy"
+
 [[exemptions.cc]]
 version = "1.2.64"
 criteria = "safe-to-run"
 
-[[exemptions.cfg-if]]
-version = "1.0.4"
-criteria = "safe-to-deploy"
-
 [[exemptions.clap]]
 version = "4.6.1"
 criteria = "safe-to-deploy"
@@ -117,10 +123,6 @@ criteria = "safe-to-run"
 version = "1.0.5"
 criteria = "safe-to-deploy"
 
-[[exemptions.constant_time_eq]]
-version = "0.3.1"
-criteria = "safe-to-run"
-
 [[exemptions.cpufeatures]]
 version = "0.2.17"
 criteria = "safe-to-deploy"
@@ -129,10 +131,6 @@ criteria = "safe-to-deploy"
 version = "1.5.0"
 criteria = "safe-to-deploy"
 
-[[exemptions.crunchy]]
-version = "0.2.4"
-criteria = "safe-to-deploy"
-
 [[exemptions.crypto-common]]
 version = "0.1.7"
 criteria = "safe-to-deploy"
@@ -181,10 +179,6 @@ criteria = "safe-to-deploy"
 version = "0.14.7"
 criteria = "safe-to-deploy"
 
-[[exemptions.getrandom]]
-version = "0.3.4"
-criteria = "safe-to-run"
-
 [[exemptions.gif]]
 version = "0.14.2"
 criteria = "safe-to-deploy"
@@ -197,10 +191,6 @@ criteria = "safe-to-deploy"
 version = "0.17.1"
 criteria = "safe-to-deploy"
 
-[[exemptions.hmac]]
-version = "0.12.1"
-criteria = "safe-to-run"
-
 [[exemptions.image]]
 version = "0.25.10"
 criteria = "safe-to-deploy"
@@ -209,10 +199,6 @@ criteria = "safe-to-deploy"
 version = "0.2.4"
 criteria = "safe-to-deploy"
 
-[[exemptions.inout]]
-version = "0.1.4"
-criteria = "safe-to-run"
-
 [[exemptions.inventory]]
 version = "0.3.24"
 criteria = "safe-to-deploy"
@@ -261,10 +247,6 @@ criteria = "safe-to-deploy"
 version = "0.8.1"
 criteria = "safe-to-deploy"
 
-[[exemptions.num-conv]]
-version = "0.2.2"
-criteria = "safe-to-deploy"
-
 [[exemptions.once_cell]]
 version = "1.21.4"
 criteria = "safe-to-deploy"
@@ -275,7 +257,7 @@ criteria = "safe-to-deploy"
 
 [[exemptions.pbkdf2]]
 version = "0.12.2"
-criteria = "safe-to-run"
+criteria = "safe-to-deploy"
 
 [[exemptions.pin-project-lite]]
 version = "0.2.17"
@@ -325,26 +307,10 @@ criteria = "safe-to-deploy"
 version = "1.0.23"
 criteria = "safe-to-deploy"
 
-[[exemptions.serde]]
-version = "1.0.228"
-criteria = "safe-to-deploy"
-
-[[exemptions.serde_core]]
-version = "1.0.228"
-criteria = "safe-to-deploy"
-
-[[exemptions.serde_derive]]
-version = "1.0.228"
-criteria = "safe-to-deploy"
-
 [[exemptions.serde_json]]
 version = "1.0.150"
 criteria = "safe-to-deploy"
 
-[[exemptions.sha2]]
-version = "0.10.9"
-criteria = "safe-to-deploy"
-
 [[exemptions.shlex]]
 version = "2.0.1"
 criteria = "safe-to-run"
@@ -361,10 +327,6 @@ criteria = "safe-to-deploy"
 version = "1.1.1"
 criteria = "safe-to-deploy"
 
-[[exemptions.subtle]]
-version = "2.6.1"
-criteria = "safe-to-deploy"
-
 [[exemptions.syn]]
 version = "2.0.118"
 criteria = "safe-to-deploy"
@@ -385,10 +347,6 @@ criteria = "safe-to-deploy"
 version = "0.3.49"
 criteria = "safe-to-deploy"
 
-[[exemptions.time-core]]
-version = "0.1.9"
-criteria = "safe-to-deploy"
-
 [[exemptions.time-macros]]
 version = "0.2.29"
 criteria = "safe-to-deploy"
@@ -433,10 +391,6 @@ criteria = "safe-to-deploy"
 version = "0.1.12"
 criteria = "safe-to-deploy"
 
-[[exemptions.windows-link]]
-version = "0.2.1"
-criteria = "safe-to-deploy"
-
 [[exemptions.windows-sys]]
 version = "0.61.2"
 criteria = "safe-to-deploy"
@@ -465,10 +419,6 @@ criteria = "safe-to-run"
 version = "7.2.0"
 criteria = "safe-to-deploy"
 
-[[exemptions.zlib-rs]]
-version = "0.6.3"
-criteria = "safe-to-deploy"
-
 [[exemptions.zopfli]]
 version = "0.8.3"
 criteria = "safe-to-deploy"