deps: update h2 to 0.4.16

[jscott3201]

Summary

• update the locked h2 package from 0.4.15 to patched 0.4.16
• resolve RUSTSEC-2026-0258, a low-severity denial-of-service advisory involving unbounded empty DATA frames
• preserve every other package version, checksum, and dependency edge

Primary evidence:

• https://rustsec.org/advisories/RUSTSEC-2026-0258.html
• https://github.com/hyperium/h2/releases/tag/v0.4.16

Scope

Cargo.lock only: two insertions and two deletions. No manifest, source, test, CI, or public API changes.

The initial Cargo-generated update also normalized four unrelated dependency edges. Those changes were removed, and cargo metadata --locked accepted the narrowed lock without mutation.

Validation

• cargo metadata --locked --all-features --format-version 1: pass
• cargo tree --workspace --all-features -i h2@0.4.16 --locked: pass
• cargo audit: pass, zero vulnerabilities; existing allowed yanked chacha20 0.10.1 warning remains
• cargo deny check: pass
• cargo check -p bacnet-benchmarks --all-features --locked: pass
• RUSTUP_TOOLCHAIN=1.93 bash .github/scripts/check-msrv.sh: pass across the ten canonical publishable crates
• git diff --check: pass

A direct Rust 1.93 benchmark check remains unavailable because the pre-existing sysinfo 0.39.6 benchmark dependency requires Rust 1.95; the repository canonical MSRV gate passes and h2 0.4.16 itself declares an older MSRV.

This is the immediate security follow-up authorized after PR #458.

[jscott3201]

Final gate evidence for exact head d111f48:\n\n- Immutable cycle-1 holistic review: PASS, no findings\n- Immutable cycle-1 dataflow review: PASS, no findings\n- Local: locked all-features metadata/tree, cargo audit (0 vulnerabilities), cargo deny, benchmark all-features check, canonical MSRV 1.93 script, and git diff --check: PASS\n- Lean PR run 33284677845: PASS\n- Heavy qualification run 33284712673 via temporary draft PR #461: Cargo Audit, Cargo Deny, MSRV, Ubuntu, macOS, Windows, Clippy, Rustfmt, file-size, and no-secret checks: PASS\n- Initial Windows attempt hit an isolated bacnet-client request-timer timing failure unrelated to the Cargo.lock-only diff; the user-authorized failed-job rerun passed on the unchanged head in 7m33s.\n\nPR remains a two-line lockfile-only h2 0.4.15 -> 0.4.16 update addressing RUSTSEC-2026-0258.