chore(audit): ignore RUSTSEC-2025-0023 (#2565)

* chore(audit): ignore RUSTSEC-2025-0023

RUSTSEC-2025-0023 discloses a vulnerability in Tokio: "Broadcast channel
calls clone in parallel, but does not require `Sync`".

https://rustsec.org/advisories/RUSTSEC-2025-0023

Tokio is only used in neqo-bin. neqo-bin does not make use of Tokio's broadcast
channels. neqo-bin is not used by Firefox.

All Tokio versions with a fix for RUSTSEC-2025-0023 require a libc
version bump, i.e. require us to use a libc version other than what
mozilla-central uses.

Thus, instead of updating Tokio, this commit simply ignores the CVE.

* Add FIXME to update once mozilla-central updates libc dep

* newline

* Fix comment

Author: mxinden

.deny.toml

@@ -26,3 +26,6 @@ allow = [
 unknown-registry = "deny"
 unknown-git = "deny"
 required-git-spec = "rev"
+
+[advisories]
+ignore = ["RUSTSEC-2025-0023"] # FIXME: Remove this once Firefox moves to libc >= 0.2.168