[bitner]

Upgrades the dependencies whose version requirements kept out the latest release, updates the
lockfile for crates with security advisories, and drops unused WebAssembly dependencies. Also adds
tests and benchmarks. Library code changes only where an upgrade requires it.

Dependencies

• geojson 0.24 → 1.0, geozero 0.14 → 0.15, jsonschema 0.33 → 0.60, sqlparser 0.62 → 0.63, and
  rstest 0.26 → 0.28 (tests only).
• pyo3 and pythonize 0.26 → 0.29 for the Python package, which fixes RUSTSEC-2026-0176 and
  RUSTSEC-2026-0177. pyo3 0.30 is out, but pythonize's latest release still requires 0.29.
• crossbeam-epoch, rustls, rustls-webpki and webpki-roots are updated in the lockfile for their
  advisories. The last three are only built for the DuckDB test dependency.
• The wasm package drops getrandom 0.3, getrandom 0.4 and web-sys, which it didn't use.
  jsonschema 0.60 turns on getrandom's wasm_js feature itself.

Code changes the upgrades force:

• src/geometry.rs: geojson 1.0 renamed Value to GeometryValue, gave its variants named
  fields, and made a position a Position instead of a Vec.
• src/validator.rs: jsonschema 0.60 replaced apply and Output with evaluate and
  Evaluation. Validator::apply keeps its name and now returns Evaluation. This is the one
  breaking change to cql2's own API: use .is_valid() where you used .flag(), and .list() or
  .hierarchical() where you used .basic().
• src/sql.rs: sqlparser 0.63 removed Cast's array field and made a LIKE escape an
  expression.

The cql2-text, cql2-json and SQL output is the same as on main. I compared them with the CLI,
for WKT and GeoJSON geometries, LIKE escapes, casts and temporal literals, along with the
validation messages.

Tests and benchmarks

• tests/api.rs: the public API's conversions and helpers.
• tests/ats/expressions.txt: the value-to-value comparisons and interval relations from the OGC
  CQL2 Abstract Test Suite, and a test that each value compares equal to itself.
• tests/encoding_invariants.rs: in(...) called as a function.
• tests/reduce_tests.rs:
  • a time limit on reducing large filters;
  • an ignored test of a spatial relation geo 0.33 gets wrong for geometry collections of mixed
    dimension.
• More Python, wasm and JavaScript tests, including one that runs the examples in cql2.pyi.
• PROPTEST_CASES can raise the property tests above their usual 2000 cases.
• benches/cql2.rs: criterion benchmarks of parsing, reduce, filter, to_text and
  to_sql. Run them with cargo bench --bench cql2.
• CONTRIBUTING.md says how to run each test suite and the benchmarks.

Testing

• scripts/lint, and clippy with warnings denied over all targets
• cargo test --workspace --all-features
• the Python tests, wasm-pack test --node and the JS integration tests
• mkdocs build --strict
• cargo bench --bench cql2 -- --test
• PROPTEST_CASES=30000 cargo test --release --test proptest_roundtrip
• cargo audit: no vulnerabilities

This PR was created with the help of Claude.

[gadomski]

@bitner if you don't mind, can we split this into two PRs:

1. Dependencies and related code changes
2. Tests and benches

🙇🏼 thanks