deps: consolidate the dependency stack, cln-* 0.7 and tonic 0.14

[cdecker]

Summary

Dependency consolidation for the client libraries, paired with the corresponding Greenlight
MR — the two must land together, since gl-plugin-internal implements cln-grpc's generated
service trait and both sides have to be on the same tonic.

Lock: 544 → 514 entries, 56 → 34 crates at more than one version, 68 → 38
redundant copies.

cln-* 0.7 and tonic 0.14, in lockstep

cln-grpc 0.7 is built against tonic 0.14, and WrappedNodeServer implements its generated
Node trait using our own tonic's Request/Response/Status. Two tonic majors in one
tree therefore means the trait we implement is not the trait the server expects, so the two
bumps cannot be staged — the cln-* half alone fails with 57 errors.

Carries prost 0.12 → 0.14 and the transitive hyper 0.14 → 1.0 / http 0.2 → 1.0 /
tower 0.4 → 0.5. tonic-build no longer emits prost code (codegen moves to
tonic-prost-build, runtime gains tonic-prost), tonic::body::BoxBody is private,
http-body 1.0 replaces poll_data/poll_trailers with poll_frame, and hyper 1.0 no longer
implements its IO traits for tokio types.

The Node trait also gained 26 methods in cln 0.7; unary calls delegate to the inner server
and the new subscriptions follow the existing ones in being unimplemented pending a public
NotificationStream.

A production bug this surfaced

generate_self_signed_device_cert set IsCa::ExplicitNoCa, and since rcgen 0.13
serialize_request rejects any basicConstraints in a CSR with UnsupportedInCsr. Every
caller that turns those params into a CSR was failing — both device registration paths in
scheduler.rs and the new-device pairing flow, not only the test that caught it. NoCa
omits the extension and keeps the CSR valid; the certificate is only a vehicle for the params
and key pair here, and is discarded once the CSR is built.

Dependency hygiene

• picky: gl-client declared three crates from one family at mutually incompatible
  versions (picky 6, which internally uses picky-asn1-x509 0.6, plus direct 0.15 and
  picky-asn1-der 0.4), putting picky-asn1 in the tree three times. That skew was also why
  verify_pairing_data serialised the CSR key to DER and parsed it back — it was crossing
  between two copies of the same types. With matching versions the key is just borrowed.
  Selecting only picky's x509 feature additionally drops http 0.2.
• Unused deps removed: async-stream, sha256, uuid (gl-client), env_logger
  (gl-plugin), each confirmed by grep. futures was the one not to remove — real, but only
  under #[cfg(test)], so it moved to dev-dependencies.
• Wildcard "*" specs replaced with workspace dependencies. Cargo.lock unchanged.
• Python codegen toolchain bumped to grpcio-tools 1.81.1 with declared bounds moved up to
  match the regenerated stubs, keeping the deliberate-bump discipline the pins documented.

One behaviour change worth review

AuthService previously signed only the first body frame, because http-body 0.4's data()
returns one chunk. It now collects the whole body, which is what the signature was meant to
cover.

Rebase note

Rebased onto current main, which had gained the splice support in the meantime. Two
consequences worth calling out, both caught by rebuilding afterwards rather than by the
rebase itself:

• sha256 was flagged unused and removed; the new splice code calls sha256::digest for
  real, so it is kept. (async-stream and uuid remain genuinely unused.)
• ListpeerchannelsRequest gained server-side filters in cln 0.7, so the struct literal in
  old_splice_state needed the two new fields. Both left unset, preserving the existing
  list-then-filter behaviour.

Testing

cargo check --all --all-targets clean; 270 lib tests green.