Migrate cgmath dependency to cgmath-next (maintained successor, soundness fix)

[kent-tokyo]

Summary

Migrates the cgmath dependency to cgmath-next, a maintained, source-compatible successor.

cgmath currently has two open RustSec advisories: RUSTSEC-2026-0196 (unmaintained) and RUSTSEC-2026-0197 (a soundness issue in swap_columns). cgmath-next fixes the soundness issue and continues receiving maintenance.

What changed

-cgmath = "0.18"
+cgmath = { package = "cgmath-next", version = "0.18.1" }

That's it -- no source changes. cgmath-next's compiled library name is still cgmath, so every use cgmath::... in this crate keeps working unchanged.

Verification

• Zero unexplained public API differences against cgmath 0.18.0 (docs/api-inventory.md in cgmath-next).
• cargo check --no-default-features passes clean.
• cargo test --no-default-features --lib passes (0 tests -- this crate has none in src/, confirmed unchanged from baseline).
• three-d is one of 5 real reverse-dependency crates cgmath-next verifies against directly in its own CI/fixtures (compat/fixtures/reverse-deps/RESULTS.md).

One honest note: three-d-asset (this crate's own dependency) still depends on real cgmath internally, so both cgmath and cgmath-next end up in the build graph. This didn't cause any conflict for three-d itself (no shared scope between the two), but full leverage would eventually want three-d-asset migrated too -- happy to send that PR as well if useful.

Please don't hesitate to close this if it doesn't fit the project's direction -- happy to discuss any concerns.