chore(ci): fix deny advisories, nightly rustdoc lints, and stale forge-std pin

[stephancill]

Motivation

base-anvil-fork CI is red on several checks that are unrelated to any feature work — every open PR inherits them. This PR greens the deterministic, in-repo ones:

• deny / cargo deny check — new 2026 RUSTSEC advisories on transitive deps.
• docs / docs — nightly rustdoc now enforces rustdoc::redundant_explicit_links under -D warnings.
• test / test all — a stale forge-std pin makes forge build emit a revision-mismatch warning that breaks no-warning / snapshot CLI tests.

Solution

deny:

• crossbeam-epoch 0.9.18 → 0.9.20 (Cargo.lock) — resolves RUSTSEC-2026-0204.
• Ignore RUSTSEC-2026-0194 / RUSTSEC-2026-0195 (quick-xml <0.41 DoS). quick-xml 0.18/0.38 are transitive and the fix (>=0.41.0) isn't reachable via cargo update given foundry's dep tree; matches the existing convention in deny.toml.

docs:

• rustdoc::redundant_explicit_links flagged [revm](foundry_evm::revm) in crates/anvil/src/eth/backend/mod.rs and db.rs. Dropped the redundant explicit target so the label resolves via intra-doc link.

test all (forge-std revision mismatch):

• The shared test template (crates/test-utils/src/util.rs) runs forge init — which writes a foundry.lock pinning forge-std at bf647bd6 (v1.16.2) — then force-checks-out FORGE_STD_REVISION (= testdata/forge-std-rev). Our pin was stale at 620536fa (Apr 2026), so forge build warned:

  Warning: Dependency 'lib/forge-std' revision mismatch:
    expected 'bf647bd6046f2f7da30d0c2bf435e5c76a780c1b',
    found    '620536fa5277db4e3fd46772d5cbc1ea0696fb43'
  

  breaking build::build_no_warning_without_soldeer_lock, cmd::can_clean_without_warnings, and test_cmd::repros::issue_9272.
• Bump testdata/forge-std-rev 620536fa → bf647bd6, matching upstream foundry-rs/foundry's testdata/forge-std-rev. The checkout now matches the lock → no warning.

Verified locally:

• cargo deny --all-features check all → advisories ok, bans ok, licenses ok, sources ok
• cargo +nightly doc --workspace --all-features --no-deps --document-private-items (with CI RUSTDOCFLAGS) → clean
• forge-std-rev value confirmed against upstream foundry's pin; test / test all on this PR exercises it end-to-end.

Out of scope

• test / test external (ext_integration::gunilev, convex_shutdown_simulation) fork Ethereum mainnet over a public RPC — environmental flakes, not a base-anvil regression.

PR Checklist

• Added Tests
• Added Documentation
• Breaking changes