chore: consume irmars from crates.io and bump reqwest to 0.12

[rubenhensen]

Summary

Switches every pg-* crate from the abandoned upstream irma 0.2.1 (tweedegolf/irmars, dormant since 2021) to the encryption4all fork published on crates.io as irmars 0.2.2. Uses the Cargo `package = "irmars"` rename so existing `use irma::...` call sites are unchanged.

`irmars 0.2.2` already depends on `reqwest ^0.12` and `thiserror ^2.0`, so this single dep flip also completes the reqwest 0.12 migration that #186 tracks.

Relation to existing work

• Supersedes chore: migrate off reqwest 0.11 to clear unmaintained transitives #188. That PR vendored an irma 0.2.1 source copy at ./irma/ and patched its reqwest dep locally — a workaround for the absence of a published reqwest-0.12 release. With the encryption4all fork now on crates.io, the vendored copy is no longer needed; the result is the same dependency graph with ~1300 fewer lines of code in this repo.
• Closes chore: migrate postguard off reqwest 0.11 (to clear unmaintained transitives) #186 — the underlying audit-allowlist tracking issue.

Changes

File	Change
pg-core/Cargo.toml	irma = "0.2.1" -> irma = { package = "irmars", version = "0.2.2" }
pg-cli/Cargo.toml	irma rename as above; reqwest = "0.11.14" -> "0.12" (kept default-features = false with json + default-tls)
pg-pkg/Cargo.toml	irma rename as above; reqwest = "0.11.10" -> "0.12"
.cargo/audit.toml	RUSTSEC-2025-0134 (rustls-pemfile) entry removed. RUSTSEC-2026-0058 (tokio-io) retained with an updated comment — see Caveat.
Cargo.lock	Regenerated.

Caveat: tokio-io advisory partially cleared

The reqwest 0.11 path is gone, but RUSTSEC-2026-0058 (tokio-io 0.1.13) still surfaces through futures-util's compat feature pulled in by tower-http (a reqwest 0.12 transitive) and by sqlx-*. postguard does not call the compat shim directly; the allowlist entry is retained with a revised comment. Clearing it needs a tower-http / sqlx upstream fix.

Verification

• cargo build --workspace — clean.
• cargo test --manifest-path pg-core/Cargo.toml --features test,rust,stream — passed.
• cargo test --manifest-path pg-cli/Cargo.toml --all-features — 7 passed.
• cargo test --manifest-path pg-pkg/Cargo.toml --all-features — 30 passed.
• cargo test --manifest-path pg-ffi/Cargo.toml --all-features — 1 passed.
• cargo build --profile edge --bin pg-pkg — clean (matches Docker CI invocation).
• pg-wasm is excluded from the workspace and doesn't depend on irma or reqwest, so no change there.

Reviewer quickstart

git fetch origin && git checkout chore/use-irmars-from-crates-io
cargo build --workspace
cargo audit

Once this merges

Please close PR #188 ("chore: migrate off reqwest 0.11 to clear unmaintained transitives") as superseded — GitHub doesn't auto-close PRs from a Supersedes reference, only issues.

[dobby-coder]

Reviewed locally. LGTM.

Verified

• Workspace builds clean (cargo build --workspace).
• pg-core (--features test,rust,stream) and pg-pkg (--all-features) tests pass — 30 in pg-pkg, doc-tests in pg-core.
• crates.io irmars 0.2.2 is owned by encryption4all and points at encryption4all/irmars — legit fork.
• Cargo.lock now resolves irmars 0.2.2 with reqwest ^0.12 and thiserror ^2.0, dropping the 0.11.x chain. rustls-pemfile 1.0.4 and the base64 0.21 duplicate are gone; hyper 1.x, h2 0.4, http 1.4, http-body 1.0 are in.
• .cargo/audit.toml correctly drops RUSTSEC-2025-0134 (no longer reachable post-reqwest-0.12) and rewrites the RUSTSEC-2026-0058 comment to reflect the new transitive path through tower-http + sqlx-* futures-util compat. Accurate.
• Cargo package = "irmars" rename keeps use irma::... call sites untouched — confirmed no source changes needed.

Notes (non-blocking)

• pg-cli adds default-tls to reqwest's feature list (was just ["json"] on 0.11). Reasonable since reqwest 0.12 split TLS feature flags differently and HTTPS wouldn't work without it.
• This cleanly supersedes PR #188 — same end state, ~1300 fewer LOC, no vendored crate to maintain. Worth closing #188 manually after merge as the description notes.

CI is fully green on the formatting + test matrices; only Build (amd64) still pending at review time. Approving.