`wasmtime-wasi` was locked to 36.0.12, which resolved the vulnerable
`cap-primitives` 3.4.4 release. That version is affected by a
trailing-slash symlink handling issue that can bypass capability
filesystem confinement.

Raise the workspace's minimum `wasmtime-wasi` version to 36.0.14 and
refresh the Wasmtime dependency family. This resolves `cap-primitives`
to the patched 3.4.6 release while remaining on Wasmtime's existing 36.x
line.

Verified with `cargo check --locked -p extension_host` and by confirming
the reverse dependency tree resolves `cap-primitives` 3.4.6 through
`wasmtime-wasi` 36.0.14.

See
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg

Release Notes:

- Fixed a potential filesystem sandbox escape when running extensions.