deps: bump hkdf 0.12→0.13 and sha2 0.10→0.11.0-rc.5

mainline 6.1.2 loosened its digest pin, unblocking hkdf 0.13 (which
needs digest 0.11). sha2 stays on the prerelease '=0.11.0-rc.5' to
match iroh-base's hard-pin; can drop the '=' once iroh-base relaxes.

HKDF-SHA256 KAT (keys_hkdf_kat_passphrase_abc_app_test_v1_k3) passes
byte-for-byte, so on-wire/on-disk key material is unchanged.

Updates the pinning rationale comment in Cargo.toml accordingly.

Cargo.lock

@@ -979,7 +979,6 @@ checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer 0.10.4",
  "crypto-common 0.1.7",
- "subtle",
 ]
 
 [[package]]
@@ -991,6 +990,7 @@ dependencies = [
  "block-buffer 0.12.0",
  "const-oid 0.10.2",
  "crypto-common 0.2.1",
+ "ctutils",
 ]
 
 [[package]]
@@ -1603,20 +1603,20 @@ dependencies = [
 
 [[package]]
 name = "hkdf"
-version = "0.12.4"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
+checksum = "4aaa26c720c68b866f2c96ef5c1264b3e6f473fe5d4ce61cd44bbe913e553018"
 dependencies = [
  "hmac",
 ]
 
 [[package]]
 name = "hmac"
-version = "0.12.1"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
 dependencies = [
- "digest 0.10.7",
+ "digest 0.11.2",
 ]
 
 [[package]]
@@ -2102,7 +2102,7 @@ dependencies = [
  "mutants",
  "proptest",
  "rand 0.9.4",
- "sha2 0.10.9",
+ "sha2 0.11.0-rc.5",
  "stateright",
  "thiserror 2.0.18",
  "tokio",