Drop mail-auth's 'generate' feature: removes RUSTSEC-2023-0071

cargo-deny's advisory check caught the rsa crate (RUSTSEC-2023-0071, the
Marvin Attack — private-key recovery through a timing sidechannel that is
observable over the network, with no fixed version available).

Root cause was ours: enabling mail-auth's 'generate' feature, which exists
to create DKIM keypairs and pulls in the pure-Rust rsa implementation. The
default aws-lc-rs backend signs and verifies in constant time, which is what
a service listening on :25 actually needs. Key generation is a one-time
operator action and belongs in tooling (openssl genpkey), not in the daemon.

Fixed by removing the feature rather than by adding an advisory exception —
the reason is recorded inline in Cargo.toml so nobody re-adds it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JkyvfNJGTshJNE9FtwPLk7

Cargo.lock

@@ -1364,8 +1364,6 @@ dependencies = [
  "mail-builder 0.4.4",
  "mail-parser",
  "quick-xml",
- "rand 0.8.8",
- "rsa",
  "rustls-pki-types",
  "serde",
  "serde_json",

Cargo.toml

@@ -44,7 +44,14 @@ openmail-mcp     = { version = "0.1.0", path = "crates/openmail-mcp" }
 # --- third party (all Apache-2.0 or MIT; see NOTICE) ---
 mail-parser      = { version = "0.11", features = ["full_encoding"] }
 mail-builder     = "0.5"
-mail-auth        = { version = "0.12", features = ["generate"] }
+# NO "generate" feature. It pulls in the `rsa` crate, which carries
+# RUSTSEC-2023-0071 (Marvin Attack — private-key recovery through a timing
+# sidechannel observable over the network) with no fixed version available.
+# The default `aws-lc-rs` backend signs and verifies in constant time, which is
+# what a network service actually needs. DKIM keypair generation is a one-time
+# operator action and belongs in tooling (`openssl genpkey`), not in a daemon
+# listening on :25.
+mail-auth        = { version = "0.12" }
 smtp-proto       = "0.2"
 hickory-resolver = { version = "0.26", features = ["dnssec-ring"] }