chore(deps): follow up the dependencies held back in the v0.8.0 update #2823

Follow-up to #2819. Land these in one PR when upstream allows; an item still blocked upstream stays open here rather than holding the others.

(a) hf-hub at 0.5.0, latest 1.0.0

hf-hub 1.0 pulls hf-xet, whose default rustls-tls enables reqwest rustls and so aws-lc-rs, which downstream cannot turn off. It is also an async rewrite with no api::sync. Staying on 0.5.0 keeps reqwest 0.12 and native-tls in the graph.

• Move when aws-lc-rs can be avoided, keeping HF_ENDPOINT, token, cache dir and error mapping behavior.

(b) TypeScript at 6.0.3, latest 7.0.2

typescript-eslint 8.72 requires below 6.1, and TypeScript 7 removes the compiler API (transpileModule) used by webui/tests/models-fixtures.ts.

• Move once typescript-eslint allows it and webui/tests/models-fixtures.ts no longer needs that API.

(c) minimatch in webpage/site

One moderate advisory (below 11.0.1), dev only, through eslint 10's ^10.2.6 requirement.

• Resolved through an eslint update, without forcing it with overrides.

(d) Transitive pins

• matchit 0.8.4 (axum) and generic-array 0.14.7 (crypto-common) move when their parents allow.

(e) Gate coverage

The xla-iree feature cannot compile without IREE_DIST, so the #2819 local gate missed a compile failure fixed by #2820.

• Decide and record whether dependency updates should wait for the OpenXLA job before merge.

Note

The cargo-audit local advisory fetch fails with "Refusing to initialize the non-empty directory" at ~/.cargo/advisory-db, while cargo deny advisories work.