fix: pin lopdf to 0.42.0 to close RUSTSEC-2026-0187 explicitly

[hisayya]

Summary

RUSTSEC-2026-0187 (transitive DoS via pdf-inspector -> lopdf) is already resolved upstream because pdf-inspector 1.14.2 depends on lopdf 0.42.0. This PR makes the fix explicit and scanner-visible:

• Add lopdf = "0.42.0" as a direct dependency with a comment citing RUSTSEC-2026-0187
• Update Cargo.lock accordingly

Why

• Future dependency-resolution changes cannot silently regress lopdf below the patched version
• cargo audit / dependabot / security scanners can see the pin directly

Testing

• cargo build passes (dev profile) under the project's CI-equivalent flags

Branch ready: hisayya/anydoc : fix/rustsec-2026-0187-lopdf