deps: bump webbrowser to 1.2.4 to fix RUSTSEC-2026-0257 (CI audit failure)

[xjoker]

Problem

The CI Format and audit job (cargo audit) is failing on dev and on every open PR:

Crate:    webbrowser
Version:  1.2.1
Title:    Unix `BROWSER` handling allows browser argument injection
ID:       RUSTSEC-2026-0257
Solution: Upgrade to >=1.2.2

This is a pre-existing dependency advisory (published 2026-07-29), unrelated to any feature branch — it fails the audit job for all PRs including the Dependabot ones.

Fix

cargo update -p webbrowser → 1.2.1 → 1.2.4, which stays within the existing webbrowser = "1" requirement in Cargo.toml. Lockfile-only change (also pulls in transitive objc2-app-kit / objc2-core-foundation / dispatch2 bumps that webbrowser 1.2.4 requires on macOS).

Verification (Linux)

• cargo build — OK
• cargo audit — now exits 0:

Crate:     lru
Version:   0.18.0
Warning:   unsound  (RUSTSEC-2026-0253)
warning: 1 allowed warning found
AUDIT_EXIT=0

The remaining lru 0.18.0 unsound advisory (RUSTSEC-2026-0253) is a transitive dep of ratatui-core and only a warning — CI runs plain cargo audit (no --deny warnings), so it does not fail the job. Fixing it requires an upstream ratatui release and is out of scope here.

Note

Once this merges to dev, the audit job on other open PRs (e.g. #62 and the Dependabot bumps) will pass on re-run, since pull_request CI checks out the PR merged into dev.