fix(ci): patch rustls, share one Postgres

[LKSNDRTMLKV]

Two things were keeping main red or about to go red.

1. Postgres integration tests hung on main (run 38570274487). The job started a fresh postgres:17 container per test, so nextest's first four tests all pulled the image at the same moment. That takes 11-19s when the registry answers; in that run all four sat past the 120s hang cutoff with nothing passing. A re-run of the failed job went green, so nothing in the code was wrong. The commit that went red (#463) only touched dependabot.yml.

test-integration already avoids this by pointing the tests at one shared server (ODAL_TEST_PG_ADMIN_URL) and cloning a database from a migrated template. test-postgres predates that and never got it. This gives it the same postgres:17 service container and env var. The runner pulls a service image once, before any step starts, and the tests have nothing left to pull. Every test in pg_integration goes through start_pg(), so none needs a container of its own. The job and its name are unchanged, since the name is what the ruleset's required check refers to.

2. Security audit fails on rustls 0.23.45. Four advisories published today (RUSTSEC-2026-0346, -0347, -0348, -0349) are all fixed in 0.23.46. The same advisories are why Security audit is red on the open Dependabot branches. rustls is only a transitive dependency (reqwest, sqlx, bollard), so this is a lockfile-only bump of that one package, version and checksum, with no other entry touched. Without it this PR's own audit job would fail.

just check passes locally.