Bump to v0.12.10 — security: Tauri, rustls-webpki, rand, dompurify, postcss

Clears all Dependabot alerts except glib (pinned upstream by Tauri's gtk-rs
stack via wry — waits for upstream).

- Tauri 2.10.3 → 2.11.1 (Origin Confusion IPC fix, + wry/tao/tray-icon bumps)
- rustls-webpki 0.103.10 → 0.103.13 (high-severity DoS panic on malformed CRL)
- rand 0.8.5 → 0.8.6, rand 0.9.2 → 0.9.4 (soundness with custom loggers)
- dompurify 3.3.2 → 3.4.2 (four sanitization bypasses)
- postcss 8.5.8 → 8.5.14 (XSS via unescaped </style>)

No functional changes. Smoke tested on Linux: build clean, app starts, feed
renders, podcast playback works, login flow works.

package.json

@@ -1,7 +1,7 @@
 {
   "name": "vega",
   "private": true,
-  "version": "0.12.9",
+  "version": "0.12.10",
   "type": "module",
   "scripts": {
     "dev": "vite",
@@ -23,7 +23,7 @@
     "@tauri-apps/plugin-process": "^2.3.1",
     "@tauri-apps/plugin-updater": "^2.10.0",
     "@types/dompurify": "^3.0.5",
-    "dompurify": "^3.3.2",
+    "dompurify": "^3.4.0",
     "highlight.js": "^11.11.1",
     "marked": "^17.0.4",
     "marked-highlight": "^2.2.3",