[JasonVranek]

Updates rustls-webpki to 0.103.16 and webpki-roots / webpki-root-certs to 1.0.11, and sets the version to 0.12.0-rc2 for the next pre-release.

The keys of eight eMudhra intermediate CAs can be recomputed from their public certificates, so anyone can issue a certificate through them. Before this change, relay HTTP connections and the bid streams accept such a certificate.

• rustls-webpki 0.103.16 rejects any chain that contains one of the eight keys, whichever root store supplied the anchor. That includes their Sectigo cross-signs (RUSTSEC-2026-0382).
• webpki-roots 1.0.11 drops emSign ECC Root CA - G3, which issued them, and two more eMudhra roots Mozilla has since removed (RUSTSEC-2026-0381).
• webpki-root-certs is only built for wasm. Its bump clears RUSTSEC-2026-0383.

These crates are younger than the 14-day publish-age cooldown on purpose, so the cooldown check will warn. Security Audit will still fail on RUSTSEC-2026-0387 (crypto-bigint 0.5.5, through alloy's k256), published October 23. That advisory is unrelated to this change, is already on main, and has no fix on the 0.5 line.

Tested

Commit-Boost was pointed at the four public eMudhra test hosts: emSign-rooted and Sectigo cross-signed, each with and without CT logging. Each host was configured once as an HTTP relay and once as a get_header stream relay, using a CA store that still trusts the eMudhra root.

• This branch refuses all eight connections with CertDistrusted.
• The v0.12.0-rc1 release binary completes TLS on six of them in the same setup.
• The ePBS bid stream builds the same TLS config as the get_header stream.
• cargo test --workspace --exclude cb-bench-micro: 439 passed.