Update chacha20, which was yanked

Update chacha20, which was yanked cargo-deny started failing on this branch without any dependency change of mine: chacha20 0.10.1 was yanked from crates.io between runs, and the advisories check treats a yanked crate as a failure. 0.10.2 replaces it. The 0.9.1 in the tree stays — it is held there by a transitive semver requirement, it is not the yanked version, and the full check now reports advisories, bans, licenses and sources all clean.