Watch: remove cowlib GHSA-g2wm-735q-3f56 ignore once upstream patches

Background

PR #4790 wired mix deps.audit into the CircleCI lint job. To keep CI
green we pass --ignore-advisory-ids GHSA-g2wm-735q-3f56 — a low-severity
cowlib cookie-parsing issue that has no upstream fix at time of
writing. We don't construct cookies server-side from untrusted input,
so the advisory isn't reachable in our code paths (this is documented in
the PR #4789 description).

The ignore is explicit and reviewable, but it shouldn't be permanent.

Unblock when

Cowlib ships a release that patches GHSA-g2wm-735q-3f56. Signals to
watch for:

• The advisory page above flips from "no known patched versions" to
  listing a patched release.
• A new cowlib release on hex.pm with a CHANGELOG entry referencing
  the GHSA.
• mix hex.outdated cowlib shows an available bump after we've already
  bumped through the rest of the cowboy 2.x line.

Action when unblocked

1. Bump cowlib in mix.lock (and cowboy if needed).
2. Remove --ignore-advisory-ids GHSA-g2wm-735q-3f56 from
   .circleci/config.yml (the deps.audit step in the lint job).
3. Confirm mix deps.audit runs clean locally and in CI.

Recheck cadence

Quarterly, or any time we're already touching cowboy/cowlib deps.

When a patched cowlib release is available, check the advisory and the cowlib changelog, then inspect mix.lock and the deps.audit step in .circleci/config.yml. Bump cowlib (and cowboy if needed), remove the GHSA ignore, and run mix deps.audit locally and in CI until both pass cleanly.