chore: allow quick-xml 0.41 to fix RUSTSEC advisories

[23Skidoo]

Widens the quick-xml version bound from <=0.40 to <=0.41 in both [dependencies] and [build-dependencies].

quick-xml 0.40 is affected by two denial-of-service advisories, both patched in 0.41.0:

• RUSTSEC-2026-0194 — quadratic run time when checking a start tag for duplicate attribute names.
• RUSTSEC-2026-0195 — unbounded namespace-declaration allocation in NsReader.

With the current <=0.40 cap, downstreams can't resolve to the fixed release. quick-xml is only used here to parse the bundled, trusted metadata XML at build time, so the DoS isn't reachable in practice — but the cap still blocks consumers from clearing the advisory, and cargo deny fails for them.

No source changes are needed — the crate builds and the full test suite passes against quick-xml 0.41.0:

• cargo build — clean.
• cargo test — 90 passed / 0 failed (plus the integration/doc suites).
• cargo fmt --check — clean.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.15%. Comparing base (2002043) to head (f255816).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #108      +/-   ##
==========================================
+ Coverage   68.10%   68.15%   +0.04%     
==========================================
  Files          18       18              
  Lines        2179     2179              
==========================================
+ Hits         1484     1485       +1     
+ Misses        695      694       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[rubdos]

Thank you. Backported onto v0.3 at c006f1a. Bumped assets and published v0.3.10+9.0.33. Thanks!