`sqlx-mysql` pulls in the vulnerable `rsa` crate. Janus only works with
PostgreSQL, so we don't need that driver at all. `janus_aggregator_core`
already enables the slim feature set we need, so we add
`default-features = false` to the workspace level dependency to turn off
the rest (`cargo` is unhappy if we put `default-features = false` in
`aggregator_core/Cargo.toml`).

Note that due to an outstanding `cargo` issue ([1], [2]), `sqlx-mysql` and
`sqlx-sqlite` still appear in `Cargo.lock`, but are never used or even
compiled.

[1]: launchbadge/sqlx#2579
[2]: rust-lang/cargo#10801

We can't update the dependency until `opentelemetry-prometheus` either
moves to a fixed `protobuf` or adds a feature letting us opt out of
protobuf support. Either way, this advisory doesn't apply to Janus per
the reasoning in deny.toml.