Reduce number of duplicate dependencies

We need to do a pass to reduce the number of duplicate dependencies by auditing some unmaintained dependencies and making sure that our owned dependent crates are up to date. Some Notes below on some of the discovered issues::

## sources of sha2 duplicates

* Update `tough` crates to sha2
* authenticode 0.5/0.6 is still tied to 0.10 sha2

## sources of bitflags and some

* fatfs hasn't been updated in 3 years, we could remove the need of this by owning a 400LoC replacement for the fatfs extraction in pcrsys

Start by auditing the dependency graph for duplicate sha2 and bitflags versions, focusing on the tough crates, authenticode 0.5/0.6, and fatfs mentioned in the issue. Check which owned dependent crates can be updated and whether fatfs is still required by pcrsys. Done means reducing duplicate dependencies while preserving the affected extraction behavior.

Written by the indexing model from the issue text.