Update h2 to address RUSTSEC-2026-0258

[terjekv]

Summary

• update transitive h2 from 0.4.15 to 0.4.16
• address RUSTSEC-2026-0258 (unbounded processing of empty HTTP/2 DATA frames)
• record the security fix in the unreleased changelog

The update remains within the existing reqwest/hyper dependency constraints and preserves Rust 1.88 compatibility. No public API, feature, server-target, or OpenAPI changes are included.

Verification

• cargo fmt --all -- --check
• cargo run -p hubuum_reconcile --locked -- check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• RUSTDOCFLAGS="-D warnings" cargo doc --workspace --all-features --no-deps
• cargo test --workspace --all-features --locked
• all five supported public feature combinations
• cargo +1.88 check --workspace --all-targets --all-features --locked
• cargo audit with the current RustSec database
• cargo deny check bans licenses sources
• ./scripts/run-integration-tests.sh --with-e2e-client -- --test-threads=1 against the pinned v0.0.9 server image (89 library integration tests plus the complete standalone consumer suite)