wire-codec 1.2.0

# wire-codec v1.2.0

Fixes from the 2026-11 independent review. No breaking changes; MSRV stays
1.85.

## Bounded constructors with an explicit limit

`LengthPrefixed::new` and `Delimited::new` build unbounded framers: a `U32`
length prefix allows 4 GiB per frame and a delimiter has no limit at all,
while `VarintPrefixed::new` is capped at 8 MiB. A streaming reader in front
of a peer keeps buffering until a frame completes, so the unbounded
constructors let one connection hold as much memory as the prefix can
describe.

1.2.0 adds:

| Constructor | Limit |
| ----------- | ----- |
| `LengthPrefixed::bounded_to(width, endian, max)` | `max` (clamped to the width) |
| `Delimited::bounded_to(delimiter, max)` | `max` |
| `LengthPrefixed::unbounded(width, endian)` | the prefix maximum (the 1.0 `new`) |
| `Delimited::unbounded(delimiter)` | none (the 1.0 `new`) |

`bounded(..)` (8 MiB / 64 KiB) is unchanged.

`LengthPrefixed::new` and `Delimited::new` are **deprecated**. They behave
exactly as before in 1.x. Replace them with `bounded` or `bounded_to` for
peer input, or with `unbounded` where something else already bounds the
input. In 2.0, `new` becomes bounded.

## Faster hostile-input search without `memchr`

The default multi-byte delimiter search scanned for the delimiter's first
byte and compared at every hit, so input built from that byte scanned about
200 times slower than ordinary input. It now scans for the last byte and
switches to a Horspool skip table after a few failed candidates. Results are
identical; a new test checks it against a naive search on dense input and
counts compares on hostile input.

## Not changed

- `Checksummed` over a resumable framer can rescan a frame while its
  checksum trailer is still arriving (bounded by the trailer length), and
  `FrameCodec` gives tokio no reserve hint. Both are small performance items
  left for a later release.