Hoist shared deps to [workspace.dependencies]

Moves third-party deps used by more than one crate into the workspace table. Members reference them with '<name>.workspace = true' (or the extended form when they need extra features), so version bumps happen in one place. Single-use deps stay in their member Cargo.toml.