`-Z minimal-versions` resolves known vulnerable dependencies

Running cargo-audit with minimal dependency versions:

RUSTC_BOOTSTRAP=1 cargo update -q -Zminimal-versions
cargo audit -q

reports 3 vulnerabilities:

• bytes 1.5.0 — RUSTSEC-2026-0007 — fixed in 1.11.1
• hashbrown 0.15.0 — RUSTSEC-2024-0402 — fixed in 0.15.1
• remove_dir_all 0.5.0 — RUSTSEC-2023-0018 — fixed in 0.8.0

If these advisories do not affect Tokio, it would be helpful to document why they are not exploitable, e.g. in deny.toml.