chore(#2510): bump indicatif/tower-http/hmac/sha2 to latest majors

Bumps the feature (major) versions that update cleanly without breaking the
build: indicatif 0.17->0.18, tower-http 0.6->0.7, hmac 0.12->0.13,
sha2 0.10->0.11. Only adaptation needed: import hmac's KeyInit trait in
webhook_secret (new_from_slice moved from Mac to KeyInit in hmac 0.13).

Held back (require dedicated code-change PRs, out of scope for a
non-breaking bump):
- reqwest 0.13: renames the rustls-tls feature and conflicts with
  forgejo-api 0.11 + matrix-sdk 0.14 which pin reqwest 0.12.
- rusqlite 0.40: libsqlite3-sys 0.38 clashes with matrix-sdk-sqlite 0.14's
  0.35 (single links=sqlite3) — coupled to the matrix-sdk bump.
- rmcp 2.2, matrix-sdk 0.18: major API rewrites across the MCP/matrix crates.

Cargo.toml

@@ -41,13 +41,13 @@ chrono = { version = "0.4", default-features = false, features = [
 ] }
 clap = { version = "4", features = ["derive"] }
 clap_complete = "4"
-indicatif = "0.17"
+indicatif = "0.18"
 hive-sh4re = { path = "hive-sh4re" }
 hive-claude = { path = "hive-claude" }
 hive-host-sock = { path = "hive-host-sock" }
 hive-priv-sock = { path = "hive-priv-sock" }
 thiserror = "2"
-tower-http = { version = "0.6", features = ["fs"] }
+tower-http = { version = "0.7", features = ["fs"] }
 rmcp = { version = "1.7", default-features = false, features = [
   "server",
   "macros",
@@ -96,5 +96,5 @@ matrix-sdk = { version = "0.14", default-features = false, features = [
   "e2e-encryption",
 ] }
 futures-util = "0.3"
-hmac = "0.12"
-sha2 = "0.10"
+hmac = "0.13"
+sha2 = "0.11"

hive-c0re/src/webhook_secret.rs

@@ -66,7 +66,7 @@ fn hex_encode(bytes: &[u8]) -> String {
 ///
 /// Forgejo sends: `sha256=<hex>`.
 pub fn verify_signature(secret: &str, body: &[u8], header: &str) -> Result<()> {
-    use hmac::{Hmac, Mac};
+    use hmac::{Hmac, KeyInit, Mac};
     use sha2::Sha256;
 
     let sig_hex = header