fix(desktop): update vulnerable nostr relay pool

[BrianInAz]

Summary

• update the independent desktop lockfile from nostr-relay-pool 0.44.1 to 0.44.2, fixing RUSTSEC-2026-0224
• scan the Apple Silicon desktop dependency graph in the Security job in addition to the root workspace graph
• keep vulnerabilities fatal while limiting no-fix unmaintained findings to direct workspace dependencies

Fixes #4251.

Reproduction

At upstream commit 28ae6cd2174309529305724e455c7ca082f6fe4b, the root Cargo.lock contains the fixed 0.44.2 release, but the separately resolved desktop lockfile still contains 0.44.1:

$ cargo-deny --locked \
    --manifest-path desktop/src-tauri/Cargo.toml \
    --target aarch64-apple-darwin \
    --exclude-dev \
    check --config deny.toml advisories
error[vulnerability]: Signature verification bypass
  ID: RUSTSEC-2026-0224
  Crate: nostr-relay-pool 0.44.1

The existing root-only cargo-deny check does not inspect this independent lockfile.

Solution

The desktop lockfile is pinned to 0.44.2, the first patched release. CI now runs a locked advisory scan for the supported Apple Silicon desktop target and excludes development-only dependencies. Vulnerabilities remain errors; unmaintained = "workspace" prevents unrelated, no-fix transitive notices from blocking the target-specific scan while preserving direct-dependency enforcement.

Validation

• cargo-deny check — passed
• cargo-deny --locked --manifest-path desktop/src-tauri/Cargo.toml --target aarch64-apple-darwin --exclude-dev check --config deny.toml advisories — passed
• cargo metadata --locked --manifest-path desktop/src-tauri/Cargo.toml --format-version 1 --no-deps — passed
• workflow YAML parse and git diff --check — passed
• just ci — root checks, clippy, web/desktop checks and builds, Rust unit suites, and 2,087 desktop tests passed; one unrelated paused-clock timing test failed in the parallel suite, then passed in isolation:
  cargo test --manifest-path desktop/src-tauri/Cargo.toml relay_admission::tests::concurrent_429_extends_the_window_for_parked_waiters -- --exact --nocapture

Scope

This intentionally does not change nostr-sdk; the bounded advisory fix is the patched nostr-relay-pool release already accepted in the root lockfile by #4139.