winscard 0.2.x blocks downstream sqlx 0.8 / picky upgrade chain (TryCryptoRng trait bound)

Hi — filing this as a follow-on to #537 since it's a fresh manifestation of the same RC-dependency-churn problem, with a concrete blocker for downstream users patching RUSTSEC advisories.

## Symptom

Compilation fails inside `winscard 0.2.3`'s `Dummy` RNG type when the broader dep tree advances to a `crypto-bigint` that requires `TryCryptoRng`:

```
error[E0277]: the trait bound `Dummy: crypto_bigint::rand_core::TryCryptoRng` is not satisfied
--> ~/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/winscard-0.2.3/src/scard.rs:434:13
|
432 | let signature = rsa::hazmat::rsa_decrypt_and_check(
| ---------------------------------- required by a bound introduced by this call
433 | &rsa_private_key,
```

`winscard 0.3.x` is already published on crates.io and has the newer trait impls, but `sspi 0.18.x` hard-pins `winscard 0.2.x` (no feature flag to disable the smartcard dep), so downstream consumers can't pick up the fix.

## Repro

A Cargo.toml with both sspi and a sqlx 0.8 / picky 7.0.0-rc.22+ chain in the same workspace:

```toml
[dependencies]
sspi = "0.18"
sqlx = { version = "0.8", features = ["sqlite", "runtime-tokio-native-tls", "macros", "migrate"] }
picky = "=7.0.0-rc.22" # newest that resolves; rc.23 wants =0.13.0-rc.2 hmac
ironrdp-connector = { path = "patches/ironrdp-connector" } # any consumer that pins picky
```

Cargo resolves `crypto-bigint` to a version that requires `TryCryptoRng`, breaks compile in upstream `winscard 0.2.3`.

## Downstream impact

Blocks the following advisory remediations for any project that depends on both sspi and sqlx:

- `RUSTSEC-2024-0363` — sqlx 0.7 binary-protocol misinterpretation (fixed in 0.8.1)
- `RUSTSEC-2026-0098`, `RUSTSEC-2026-0099`, `RUSTSEC-2026-0104` — three rustls-webpki@0.101.7 advisories (cleared once sqlx pulls newer rustls)

In our codebase (a multi-tenant VDI control plane that uses sspi for both CredSSP and a new WinRM Negotiate dispatcher), we documented this chain in our internal triage and currently have to suppress those four advisories with a comment pointing at this upstream blocker, despite the patches existing.

## Suggested path

Bump winscard 0.2.x → 0.3.x in sspi's hard-deps (or feature-gate winscard so consumers who don't need smartcard support can disable it). The latter is more invasive but would help everyone — many sspi users (CredSSP / Negotiate auth paths) don't touch winscard at all.

## What I tried locally

- Disabling smartcard support via sspi features — there's no `scard` feature flag; winscard is unconditional.
- Vendoring a patched winscard — diverges security-critical crypto from upstream advisories, net regression.
- Pinning picky to an older version that doesn't pull the newer crypto-bigint — works, but reintroduces #537's RC-churn problem.

Happy to test a PR or pre-release branch if you produce one. Thanks for the work on sspi.

Related:
- #537 (closed) — meta-issue on RC-dep churn
- #515 (closed) — earlier RustCrypto trait-change manifestation