fix!: Appease cargo-audit by replacing unmaintained dependencies

[genos]

According to cargo-audit, there are a few RUSTSEC advisories lurking in hugr due to unmaintained dependencies:

• fxhash, both directly and transitively via relrc
• instant, transitively via ascent
• paste, both directly and transitively via ascent

This PR replaces local fxhash usage with the suggested rustc-hash and paste with the successor pastey.

Of note: switching to rustc-hash changed a couple of the testing snapshots. I think everything is still in there, but the ordering has shuffled a bit.

Of course, the transitive dependencies require updates to ascent and relrc; see this ascent PR and this relrc one. If/when those get merged and released, we'd want to bump the versions of those packages here, too.

Output of cargo audit

$ cargo audit
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 820 security advisories (from /Users/graham/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (416 crate dependencies)
Crate:     fxhash
Version:   0.2.1
Warning:   unmaintained
Title:     fxhash - no longer maintained
Date:      2025-09-05
ID:        RUSTSEC-2025-0057
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0057
Dependency tree:
fxhash 0.2.1
├── relrc 0.4.6
│   ├── hugr-persistent 0.2.3
│   │   └── hugr 0.22.3
│   │       ├── hugr-core 0.22.3
│   │       │   ├── hugr-persistent 0.2.3
│   │       │   ├── hugr-passes 0.22.3
│   │       │   │   └── hugr 0.22.3
│   │       │   ├── hugr-llvm 0.22.3
│   │       │   │   ├── hugr-llvm 0.22.3
│   │       │   │   └── hugr 0.22.3
│   │       │   └── hugr 0.22.3
│   │       └── hugr-cli 0.22.3
│   └── hugr-core 0.22.3
├── hugr-model 0.22.3
│   ├── hugr-py 0.1.0
│   ├── hugr-core 0.22.3
│   └── hugr 0.22.3
└── hugr-core 0.22.3

Crate:     instant
Version:   0.1.13
Warning:   unmaintained
Title:     `instant` is unmaintained
Date:      2024-09-01
ID:        RUSTSEC-2024-0384
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0384
Dependency tree:
instant 0.1.13
└── ascent 0.8.0
    └── hugr-passes 0.22.3
        └── hugr 0.22.3
            ├── hugr-core 0.22.3
            │   ├── hugr-persistent 0.2.3
            │   │   └── hugr 0.22.3
            │   ├── hugr-passes 0.22.3
            │   ├── hugr-llvm 0.22.3
            │   │   ├── hugr-llvm 0.22.3
            │   │   └── hugr 0.22.3
            │   └── hugr 0.22.3
            └── hugr-cli 0.22.3

Crate:     paste
Version:   1.0.15
Warning:   unmaintained
Title:     paste - no longer maintained
Date:      2024-10-07
ID:        RUSTSEC-2024-0436
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0436
Dependency tree:
paste 1.0.15
├── hugr-py 0.1.0
├── hugr-passes 0.22.3
│   └── hugr 0.22.3
│       ├── hugr-core 0.22.3
│       │   ├── hugr-persistent 0.2.3
│       │   │   └── hugr 0.22.3
│       │   ├── hugr-passes 0.22.3
│       │   ├── hugr-llvm 0.22.3
│       │   │   ├── hugr-llvm 0.22.3
│       │   │   └── hugr 0.22.3
│       │   └── hugr 0.22.3
│       └── hugr-cli 0.22.3
├── hugr-core 0.22.3
├── ascent_base 0.8.0
│   ├── ascent_macro 0.8.0
│   │   └── ascent 0.8.0
│   │       └── hugr-passes 0.22.3
│   └── ascent 0.8.0
└── ascent 0.8.0

warning: 3 allowed warnings found

BREAKING CHANGE: replaced fxhash and paste with rustc-hash and pastey, respectively.

Title override for python releaser, since this change affects the hugr-py library but we don't want to mark it as breaking there

BEGIN_COMMIT_OVERRIDE

chore: Appease cargo-audit by replacing unmaintained dependencies

END_COMMIT_OVERRIDE

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.95%. Comparing base (9bbaf5b) to head (5bcedc4).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2572   +/-   ##
=======================================
  Coverage   82.95%   82.95%           
=======================================
  Files         254      254           
  Lines       47901    47901           
  Branches    43412    43412           
=======================================
  Hits        39734    39734           
  Misses       6106     6106           
  Partials     2061     2061           

Flag	Coverage Δ
python	91.42% <ø> (ø)
rust	82.07% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[genos]

Alas, I seem to have angered hugr-bot regarding cargo-semver again. Looking at its output, though, it doesn't seem to be regarding anything I did?

[aborgna-q]

It's a fluke to your PR being based on an older main that does not contain some merged breaking changes. They should disappear if you rebase on latest main.

[genos]

Thanks @aborgna-q! I thought I had aimed at the latest main. Looking at the GitHub-friendly options, would you prefer I update with a merge commit or a rebase?

[aborgna-q]

Either is fine, rebase may be more annoying for you to update locally.

[aborgna-q]

Awesome. Thanks for the contribution!