fix(deps): bump quick-xml/anyhow/crossbeam-epoch for RustSec advisories

[Svector-anu]

Automated dependency bumps to address disclosed RustSec advisories found by osv-scanner.

Advisories

Package	From → To	Advisory	Severity
quick-xml	0.37.5 → 0.41.0	RUSTSEC-2026-0194, RUSTSEC-2026-0195	High (DoS / mem exhaustion via untrusted XML)
anyhow	1.0.102 → 1.0.103	RUSTSEC-2026-0190	Unsoundness in Error::downcast_mut()
crossbeam-epoch	0.9.18 → 0.9.20	RUSTSEC-2026-0204	Invalid pointer deref in fmt::Pointer (transitive via crossbeam-deque)

Code changes

quick-xml 0.41 reworked text/attribute decoding. Two mechanical call-site updates (same approach as closed #2866):

• src/cmds/dotnet/dotnet_cmd.rs: BytesText::unescape() → decode()
• src/cmds/dotnet/dotnet_trx.rs: Attribute::decode_and_unescape_value → decoded_and_normalized_value(XmlVersion::default(), …)

Prior art

• fix(deps): bump quick-xml 0.37 → 0.41 (RUSTSEC-2026-0194/0195) #2866 bumped to 0.41 with the same API migration but was closed without merging (author redirected to a personal fork). Advisories remain present on develop.
• chore(deps): bump quick-xml from 0.37.5 to 0.40.1 #1742 (open) bumps only to 0.40.1, which does not clear RUSTSEC-2026-0194/0195 (fixed in 0.41.0). This PR supersedes that for the security fix.

Verification

• Reproduced locally: yes
• Command: osv-scanner scan source --recursive --no-ignore . before → 4 vulns; after → 0
• Before: quick-xml@0.37.5, anyhow@1.0.102, crossbeam-epoch@0.9.18 flagged
• After: cargo build clean; cargo test -- cmds::dotnet → 116 passed; osv-scanner → 0 remaining
• Environment: rustc stable, osv-scanner 2.5.1

No other code changes. Happy to adjust if you prefer splitting the bumps.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}