graph, graphql, store: Drop arrayref by bumping blake3 and stable-hash (#6715)

blake3 1.8.7 drops arrayref, whose crates.io account was compromised
(RUSTSEC-2026-0260). stable-hash requires it on both branches now.

Pin stable-hash by rev rather than branch so re-resolution cannot
silently move it.