chore(deps): bump base64 from 0.22.1 to 0.23.0

[dependabot]

Bumps base64 from 0.22.1 to 0.23.0.

Changelog

Sourced from base64's changelog.

0.23.0

• Added more consts for preconfigured configs and engines
• Make DecodeError::InvalidLastSymbol more clear by including the decoded value
• Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime detection and work in no_std. The engines support the standard and URL-safe alphabets.
• Update MSRV to 1.71.0
• Add support for custom padding symbols

Commits

• 9e9220a v0.23.0
• 870326e Merge pull request #306 from marshallpierce/mp/trailing-bits-docs
• fbec5f1 Document no trailing trailing bits
• 0a23549 Merge pull request #305 from marshallpierce/mp/edition-2021
• f10b7e2 Update deps & edition
• 9d21a59 Merge pull request #304 from marshallpierce/mp/custom-padding-rebase
• f70bad2 Support custom padding symbols
• 684d79c Merge pull request #301 from marshallpierce/mp/simd-gardening
• 5bf66f2 Merge pull request #284 from AbeZbm/add-tests
• d3831cf Followups to SIMD work
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[sathish-mg]

Checked before merging. 0.22 → 0.23 is a breaking bump for a 0.x crate, so I went through it rather than taking CI's word for it.

The API we use is untouched: every call site is base64::engine::general_purpose::STANDARD.encode/decode. The changelog's breaking items — DecodeError::InvalidLastSymbol now carrying the decoded value, custom padding symbols — don't apply; we never match on DecodeError anywhere. The serializer suites are exact-bytes/JSON wire fixtures, so the 582 flowcat-services and 84 flowcat-telephony tests passing across every provider and carrier feature is a real check that encode/decode output is byte-identical, not just that it compiles.

One thing the bump smuggled in, which is why this has an extra commit: 0.23 added simd-unsafe to its default features (runtime-detected AVX2/NEON engines); 0.22's default was std alone. Taking base64 = "0.23" verbatim silently pulls unsafe SIMD code into the default build — and we get nothing for it, because those are separate Simd/Avx2/Neon engine types and we only ever construct the scalar GeneralPurpose one. Pinned all three manifests to default-features = false, features = ["std"], which reproduces exactly the feature surface we had on 0.22.

Worth noting as a real follow-up rather than something to get by accident: the telephony serializers base64 every 20 ms carrier frame, so those call sites are the one place in the tree where the SIMD engines would actually pay. That wants measuring and a deliberate engine swap.

Also flagging that this leaves two base64 copies in the default build — rsipstack still pins 0.22.1. Compile time and binary size only, and not ours to fix, but it'll stay that way until rsipstack updates.

Re-ran CI after reconciling with current main. The green on this PR was from July 27, and the lockfile predated both the rubato 4 / tokio-tungstenite 0.30 bumps and #62, so it was satisfying branch protection without having been tested against anything close to the current tree. Verified the merged lock with cargo check --locked before pushing.