Patch actix-http security advisory

[tripledoublev]

Summary

• update Cargo.lock to use actix-http 3.12.1, addressing GHSA-xhj4-vrgc-hr34
• leave the Veilid/Iroh-transitive advisories unchanged because their patched versions are blocked by current upstream semver constraints

Verification

• cargo check --all-targets --all-features
• cargo fmt --check
• cargo clippy --all-targets --all-features -- -D warnings
• SAVE_VEILID_LOCAL_TEST_MODE=1 cargo nextest run --profile ci-virtual --no-fail-fast -E 'test(basic_test) | test(test_health_endpoint) | test(test_upload_list_delete)'