cargo: bump gix and its dependencies recursively

This should fix git::import_refs() issue with gix 0.71.0. Old commits could be
repopulated by importing stale refs stored in packed-refs.

GitoxideLabs/gitoxide#1928

The Zlib license is added to the allow list because foldhash appears in the
dependency chain.

Author: yuja

CHANGELOG.md

@@ -16,6 +16,9 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Fixed bugs
 
+* Fixed problem that old commits could be re-imported from Git.
+  https://github.com/GitoxideLabs/gitoxide/issues/1928
+
 ## [0.28.1] - 2025-04-04
 
 ### Security fixes