ci: least-privilege release publishing, no persisted tokens, pinned audit, checksums

- Release Builds: the build/test matrix ran ~1,400 third-party build
  scripts and tests with a contents:write token persisted in .git/config.
  It now runs with contents:read and persist-credentials: false; a
  separate publish job (no project or dependency code) downloads the
  artefacts, writes SHA256SUMS and attaches both to the release. The
  release now waits for every platform instead of publishing partially.
- CI/Fuzz checkouts don't persist credentials; cargo-audit is pinned
  (0.22.2), fails on yanked crates, and also audits fuzz/Cargo.lock;
  fuzz runs set -timeout=10 so slow-input bugs (like the IRC OSC one)
  are reported instead of hiding under libFuzzer's 20-minute default.
- updates/index.php: array-valued query parameters no longer raise
  TypeErrors/warnings; nosniff header.

.github/workflows/release-builds.yml

@@ -6,8 +6,10 @@ on:
             - "v*"
     workflow_dispatch:
 
+# Building and testing runs every dependency's build scripts and tests, so those jobs only get a
+# read token. Publishing is a separate job that never runs project or dependency code.
 permissions:
-    contents: write
+    contents: read
 
 jobs:
     build:
@@ -31,6 +33,7 @@ jobs:
             - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
               with:
                   fetch-depth: 0
+                  persist-credentials: false
 
             - name: Rust toolchain (pinned by rust-toolchain.toml)
               run: rustup show active-toolchain || rustup toolchain install
@@ -59,8 +62,26 @@ jobs:
                       build/releases/manifest-*.json
                       build/releases/version-*.txt
 
-            - name: Attach to GitHub Release
-              if: startsWith(github.ref, 'refs/tags/')
-              uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
+    publish:
+        name: Attach to GitHub Release
+        needs: build
+        if: startsWith(github.ref, 'refs/tags/')
+        runs-on: ubuntu-22.04
+        permissions:
+            contents: write
+        steps:
+            - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
               with:
-                  files: build/releases/*/NexusTerminal-*.zip
+                  path: artefacts
+            - name: Checksums
+              run: |
+                  find artefacts -name 'NexusTerminal-*.zip' | while read -r f; do
+                      (cd "$(dirname "$f")" && sha256sum "$(basename "$f")")
+                  done > SHA256SUMS
+                  cat SHA256SUMS
+            - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
+              with:
+                  files: |
+                      artefacts/*/*/NexusTerminal-*.zip
+                      artefacts/*/NexusTerminal-*.zip
+                      SHA256SUMS