borsh 0.10.3 has a security advisory

It is ultimately used by a rust-decimal dependency of `deep_space`. I need to update the trio of our custom dependencies. I can't remember why `rust-decimal` is in there, we need to update or remove it. borsh 1.0 is close to releasing, may want to wait for that. Looking at https://github.com/althea-net/deep_space/pulls?q=is%3Apr+is%3Aclosed there are probably some things I need to merge.