ci: least-privilege release publishing, no persisted tokens, pinned audit, checksums

- Release Builds: the build/test matrix ran ~1,400 third-party build
  scripts and tests with a contents:write token persisted in .git/config.
  It now runs with contents:read and persist-credentials: false; a
  separate publish job (no project or dependency code) downloads the
  artefacts, writes SHA256SUMS and attaches both to the release. The
  release now waits for every platform instead of publishing partially.
- CI/Fuzz checkouts don't persist credentials; cargo-audit is pinned
  (0.22.2), fails on yanked crates, and also audits fuzz/Cargo.lock;
  fuzz runs set -timeout=10 so slow-input bugs (like the IRC OSC one)
  are reported instead of hiding under libFuzzer's 20-minute default.
- updates/index.php: array-valued query parameters no longer raise
  TypeErrors/warnings; nosniff header.

.github/workflows/fuzz.yml

@@ -21,10 +21,12 @@ jobs:
                 working-directory: rust/fuzz
         steps:
             - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+              with:
+                  persist-credentials: false
             - run: sudo apt-get update && sudo apt-get install -y libasound2-dev
             - run: rustup toolchain install nightly --profile minimal
             - run: cargo +nightly install cargo-fuzz --locked
-            - run: cargo +nightly fuzz run ${{ matrix.target }} -- -max_total_time=120 -rss_limit_mb=2048
+            - run: cargo +nightly fuzz run ${{ matrix.target }} -- -max_total_time=120 -rss_limit_mb=2048 -timeout=10
             - name: Upload crashing inputs
               if: failure()
               uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2