chore(deps): bump cdp-sdk to 0.7 to fix vulnerable jsonwebtoken 9.3.1 (GHSA-h395-gr6q-cpjc)

[son-oz]

Summary

osv-scanner / cargo audit flag jsonwebtoken 9.3.1 (GHSA-h395-gr6q-cpjc, CVSS 5.5). The fixed version is 10.3.0+.

Dependency path

jsonwebtoken v9.3.1
└── cdp-sdk v0.1.1
    └── openzeppelin-relayer

The vulnerable copy is pulled in only by cdp-sdk (Coinbase Developer Platform SDK, used for the CDP signer). Note the tree also contains jsonwebtoken 10.4.0 via gcloud-auth — that copy is fine; only the 9.x duplicate needs to go.

Proposed fix

Bump the direct dependency in Cargo.toml:

cdp-sdk = "0.7.0"   # currently "0.1.0"; cdp-sdk 0.7 depends on jsonwebtoken ^10.3

This is a large version jump on cdp-sdk (0.1 → 0.7), so its API has likely changed:

1. Update the CDP signer integration code to the new cdp-sdk API as needed.
2. Run the CDP signer unit tests and, ideally, an integration test against CDP to confirm signing still works.
3. Verify with cargo tree -i jsonwebtoken@9.3.1 (should return nothing) and re-run osv-scanner scan source ./.

Acceptance criteria

• jsonwebtoken 9.x no longer appears in Cargo.lock.
• GHSA-h395-gr6q-cpjc no longer reported by osv-scanner / cargo audit.
• CDP signer tests pass.