Uprev Rust toolchain pins to 1.95.0 (#24684)

## Summary
- Bump the workspace Rust toolchain from `1.93.0` to `1.95.0` across
Cargo, Bazel, CI, release workflows, devcontainers, and the Codex
environment config.
- Refresh `MODULE.bazel.lock` so the Bazel Rust toolchain artifacts
match the new version.
- Leave purpose-specific toolchains unchanged, including the
`argument-comment-lint` nightly and the upstream `rusty_v8` `1.91.0`
build pin.
- Includes fixes for new lints from `just fix` and a few codex-authored
fixes for lints without a suggestion.

codex-rs/codex-client/src/custom_ca.rs

@@ -477,15 +477,13 @@ impl ConfiguredCaBundle {
                     })?;
                     certificates.push(CertificateDer::from(cert_der.to_vec()));
                 }
-                SectionKind::Crl => {
-                    if !logged_crl_presence {
-                        info!(
-                            source_env = self.source_env,
-                            ca_path = %self.path.display(),
-                            "ignoring X509 CRL entries found in custom CA bundle"
-                        );
-                        logged_crl_presence = true;
-                    }
+                SectionKind::Crl if !logged_crl_presence => {
+                    info!(
+                        source_env = self.source_env,
+                        ca_path = %self.path.display(),
+                        "ignoring X509 CRL entries found in custom CA bundle"
+                    );
+                    logged_crl_presence = true;
                 }
                 _ => {}
             }