deps: parse compose files with yaml_serde instead of serde_yaml_ng

[Jaro-c]

serde_yaml_ng 0.10.0 depends on unsafe-libyaml 0.2.11, which RUSTSEC-2024-0449 marks as unmaintained. I moved the compose parser to yaml_serde 0.10.7, the serde_yaml line maintained by the YAML organisation, on libyaml-rs 0.3.0. The API is the same, so the change is the dependency line, the two lockfiles, and the comments that named the old crate.

serde_norway, the candidate named in #2035, has not released since 2024-12-21. The pure Rust option, serde-saphyr, has no dynamic Value and needs Rust 1.89; I left it for later in #2040.

What I checked:

• The RUSTSEC-2024-0449 ignore is gone from deny.toml and .cargo/audit.toml. cargo audit --deny warnings passes at the root and in fuzz/, and cargo deny check passes.
• Each comment that described the old parser (recursion and repetition limits, Event being pub(crate), YAML 1.2 output) still holds for yaml_serde: its serializer differs from serde_yaml_ng's only in imports and lifetimes. One comment said the old crate did not expose apply_merge(), which was not true of either crate, so I reworded it.
• Locally, fmt, clippy and the fuzz targets build clean, and the suite passes except for three userns auto tests that fail the same way on develop on this machine (its subordinate ID ranges are in use).
• I compared this build with the 5.10.19 release binary on 51 compose files: the 39 in docker/awesome-compose plus anchors and merge keys, YAML 1.1 scalars, interpolation, block scalars, an alias bomb, deep flow nesting, and seven broken files (tab, unclosed quote, duplicate key, missing alias, bad indent, wrong type, empty). podup config in YAML and JSON gives the same stdout, stderr and exit code in all 102 runs, including the line and column of every parse error.

Closes #2035