borsh 0.10.3 has a security advisory

[AaronKutch]

It is ultimately used by a rust-decimal dependency of deep_space. I need to update the trio of our custom dependencies. I can't remember why rust-decimal is in there, we need to update or remove it. borsh 1.0 is close to releasing, may want to wait for that. Looking at https://github.com/althea-net/deep_space/pulls?q=is%3Apr+is%3Aclosed there are probably some things I need to merge.