[datlechin]

Summary

• rustls-webpki 0.103.15 to 0.103.16 for RUSTSEC-2026-0382: rejects chains through the distrusted emSign intermediates on every rustls connection.
• webpki-roots 1.0.9 to 1.0.10 for RUSTSEC-2026-0381: drops emSign ECC Root CA - G3 from the roots sqlx seeds for MySQL verify-full.
• Notices regenerated with build-aux/update-third-party-licenses.sh. No other crate moved.
• No changelog fragment: no Linux release has shipped these versions.

Test plan

• cargo deny --locked check advisories bans licenses sources (0.20.2): failed on main, passes here.
• verify.sh setup, build, lint, and tests for tablepro-net, tablepro-test-fixtures and the four network drivers.

Not in this PR

• webpki-root-certs 1.0.9 (RUSTSEC-2026-0383) stays: only a wasm32 and dev dependency of rustls-platform-verifier, never built for the Linux targets.