deps: swap scraper for serde_json, and take on toml

Quest reads bugzilla's REST API rather than its HTML, so serde_json arrives
and scraper leaves. The buglist page caps at 200 rows and would need
paginating to page through a year of bugs, and its rows are not something a
test can assert on.

toml is for the config file and for the series sidecar, and tokio gains
process and io-util for the qemu path. serde was already in the lock file as
a transitive dependency and is a direct one now.

Dependencies only, on purpose: this is the one commit a swap like this can be
reverted from without dragging code along with it. Checked with
cargo check --locked against this commit's own tree, where nothing imports
the new crates yet.

Cargo.toml

@@ -6,6 +6,8 @@ edition = "2024"
 [dependencies]
 clap = { version = "4.6.7", features = ["derive"] }
 reqwest = "0.13.5"
-scraper = "0.27.0"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
 thiserror = "2"
-tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
+tokio = { version = "1", features = ["macros", "rt-multi-thread", "process", "io-util"] }
+toml = "1"