Update rmcp to 3.1.1 and reduce JWT dependencies

[lucarlig]

Summary

• update rmcp and rmcp-macros from 3.0.1 to 3.1.1 while retaining the existing RMCP feature set
• run a full cargo update to the latest versions compatible with the workspace's Rust 1.96 MSRV
• consolidate jsonwebtoken 10/11 onto workspace-managed 11.0.0 and use its AWS-LC backend, which is already present through rustls
• remove the vulnerable pure-Rust RSA dependency tree and the RUSTSEC-2023-0071 advisory exception
• update the Tokio manifest requirement to the resolved latest 1.53.1 and replace full with the runtime features the workspace uses
• remove the stale webpki-roots license exception and tighten the remaining Goose/gumdrop advisory rationale

Why

RMCP 3.1.1 contains the current 2026-07-28 protocol fixes. The dependency audit also found that the gateway's JWT production and test paths used two jsonwebtoken versions with the RustCrypto backend. Reusing the existing AWS-LC backend preserves RS256/RS384/RS512 and HMAC behavior while removing the unpatched rsa crate affected by the Marvin timing advisory.

Tokio was already resolved at the latest 1.53.1, but the workspace manifest still requested 1.48.0 with full. Declaring the six runtime features used by the workspace removes parking_lot, parking_lot_core, and redox_syscall without removing application behavior.

The full all-features graph drops from 434 to 402 third-party packages (32 fewer). cargo shear and cargo machete found no unused direct dependencies. Nightly cargo update --breaking and cargo outdated --root-deps-only found no eligible direct dependency upgrades. The remaining RUSTSEC-2026-0214 exception is transitive through the load-test-only Goose crate; removing it requires a separate load-test migration.

Impact

No gateway API or MCP feature is removed. Existing RMCP auth and elicitation features remain enabled. JWT algorithms and validation behavior are unchanged.

Validation

• cargo +1.96 check --locked --workspace --all-targets --all-features
• cargo fmt --all --check
• cargo clippy --locked --workspace --all-targets -- -D warnings
• cargo nextest run --locked --workspace — 88 passed
• cargo build --locked --workspace
• cargo bench --locked --workspace --no-run
• cargo deny check advisories bans licenses
• cargo shear --check-test-targets --deny-warnings --locked
• cargo machete
• cargo audit — 0 vulnerabilities; 2 allowed informational warnings