chore(deps): bump cpal 0.17.1 -> 0.17.3 and alsa 0.10 -> 0.11

cpal 0.17.3 requires alsa 0.11, which in turn pulls alsa-sys 0.4. The
`links = "alsa"` constraint permits only one alsa-sys in the dependency
graph, so qbz-audio's direct alsa stack is raised in lockstep:
alsa 0.10 -> 0.11 and alsa-sys 0.3 -> 0.4. Both workspace lockfiles
(crates/ and src-tauri/) are updated to cpal 0.17.3 / alsa 0.11.0 /
alsa-sys 0.4.0.

No source changes required: alsa_direct.rs uses only the stable
high-level alsa API (pcm, HwParams, Format, Direction, ValueOr, mixer),
and the snd_lib_error_set_handler FFI in alsa_error_handler.rs is
unchanged in alsa-sys 0.4. Both workspaces pass cargo check.

cc

crates/qbz-audio/Cargo.toml

@@ -38,9 +38,11 @@ dirs = "6"
 
 [target.'cfg(target_os = "linux")'.dependencies]
 # ALSA for direct hardware access (bit-perfect)
-alsa = "0.10"
-# alsa-sys: direct FFI for snd_lib_error_set_handler (custom error routing)
-alsa-sys = "0.3"
+alsa = "0.11"
+# alsa-sys: direct FFI for snd_lib_error_set_handler (custom error routing).
+# Kept in lockstep with alsa (0.11 -> alsa-sys 0.4); a single alsa-sys is
+# required because of the `links = "alsa"` constraint shared with cpal.
+alsa-sys = "0.4"
 # zbus for org.freedesktop.ReserveDevice1 D-Bus client (device reservation).
 # Pinned to v4 to share the transitive copy already pulled in by
 # secret-service/souvlaki and avoid duplicate zbus compiles.