Update dependencies to get rid of quick-xml 0.39 (plus update vello_cpu) (#8411)

<!--
Please read the "Making a PR" section of
[`CONTRIBUTING.md`](https://github.com/emilk/egui/blob/main/CONTRIBUTING.md)
before opening a Pull Request!

* Keep your PR:s small and focused.
* The PR title is what ends up in the changelog, so make it descriptive!
* If applicable, add a screenshot or gif.
* If it is a non-trivial addition, consider adding a demo for it to
`egui_demo_lib`, or a new example.
* Do NOT open PR:s from your `master` branch, as that makes it hard for
maintainers to test and add commits to your PR.
* Remember to run `cargo fmt` and `cargo clippy`.
* Open the PR as a draft until you have self-reviewed it and run
`./scripts/check.sh`.
* When you have addressed a PR comment, mark it as resolved.

Please be patient! I will review your PR, but my time is limited!
-->

* [x] I have followed the instructions in the PR template

deny.toml

@@ -34,8 +34,6 @@ ignore = [
   "RUSTSEC-2024-0320", # unmaintained yaml-rust pulled in by syntect
   "RUSTSEC-2025-0141", # https://rustsec.org/advisories/RUSTSEC-2025-0141 - bincode is unmaintained - https://git.sr.ht/~stygianentity/bincode/tree/v3.0/item/README.md
   "RUSTSEC-2026-0192", # ttf-parser is unmaintained. Only brought in via winit/sctk-adwaita (wayland window frame rendering)
-  "RUSTSEC-2026-0194", # quick-xml DoS - fix is in >=0.41, but held back transitively by zbus_xml (accesskit) and wayland-scanner (winit)
-  "RUSTSEC-2026-0195", # quick-xml DoS - same as above
   "RUSTSEC-2026-0206", # rustybuzz is unmaintained. Brought in via resvg. TODO(linebender/resvg#922): Remove once the PR lands and is released
 ]
 
@@ -53,6 +51,7 @@ skip = [
   { name = "bit-vec" }, # dependency of bit-set in turn, different between 0.6 and 0.5
   { name = "bitflags" }, # old 1.0 version via glutin, png, spirv, …
   { name = "core-foundation" }, # version conflict between winit and wgpu ecosystems
+  { name = "env_filter" }, # 0.1.4 only used by android_logger, which is only used by the hello_android example
   { name = "foldhash" }, # pulled by the duplicated hashbrown versions
   { name = "getrandom" }, # ring / rustls (and thus ehttp) still depend on getrandom 0.2
   { name = "hashbrown" }, # wgpu's naga depends on 0.16, accesskit depends on 0.15