cargo(keylimectl): disable rpm default features to drop rsa dependency

The rpm crate enables signature-pgp by default, pulling in pgp -> rsa.
We only use rpm for header parsing (PackageMetadata::open/parse), not
signature verification, so the pgp feature is unnecessary.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ansasaki