feat(#2529): bump reqwest 0.12 -> 0.13

Now that matrix-sdk 0.18 is on main, reqwest 0.13.1 is already in the
tree transitively. Point the workspace crates at it directly.

reqwest 0.13 renamed the rustls feature set:
- rustls-tls -> rustls
- rustls-tls-native-roots -> rustls-native-certs
- (webpki-roots is now a separate feature)

hive-forge keeps its dual-trust story (system/native store for the
hive CA + bundled Mozilla roots for public CAs) by enabling
rustls-native-certs + webpki-roots explicitly.

forgejo-api 0.11 resolves cleanly against reqwest 0.13 (no conflict).

rusqlite 0.40 is intentionally NOT bumped here: matrix-sdk-sqlite 0.18
still pins rusqlite 0.37, so 0.40's libsqlite3-sys 0.38 would hit the
links="sqlite3" single-owner conflict. Deferred until upstream moves.

hive-forge/Cargo.toml

@@ -20,17 +20,18 @@ url.workspace = true
 time.workspace = true
 reqwest = { workspace = true, features = [
   "json",
-  # Trust the OS/system CA store (rustls-native-certs), not only the
-  # bundled webpki roots, so hive-forge validates the hive gateway's
-  # self-signed leaf once the hive CA is in the agent's trust store
-  # (embedded into agent flakes via security.pki.certificateFiles). The
-  # bundled webpki roots stay enabled (workspace `rustls-tls`), so this is
-  # additive — public CAs still validate; the native store adds the hive
-  # CA. Cargo unifies features across the build, so native-root loading is
-  # enabled for every reqwest client; harmless (a superset of roots, and
-  # on NixOS the system store already includes the Mozilla bundle).
-  "rustls-tls-native-roots",
-  "rustls-tls",
+  # Trust the OS/system CA store (`rustls-native-certs`), plus the bundled
+  # Mozilla roots (`webpki-roots`), so hive-forge validates the hive
+  # gateway's self-signed leaf once the hive CA is in the agent's trust
+  # store (embedded into agent flakes via security.pki.certificateFiles)
+  # AND public CAs still validate. Cargo unifies features across the build,
+  # so both root sources are enabled for every reqwest client; harmless (a
+  # superset of roots, and on NixOS the system store already includes the
+  # Mozilla bundle). (reqwest 0.13 renamed the 0.12 `rustls-tls` /
+  # `rustls-tls-native-roots` features to `rustls` / `rustls-native-certs`.)
+  "rustls",
+  "rustls-native-certs",
+  "webpki-roots",
   "blocking",
   "multipart",
 ] }