v1.3.5: chore: release 1.3.5 version

Security (dependencies): update the Guzzle HTTP stack to clear 5 Dependabot
advisories. The release ZIP installs dependencies from composer.lock at build
time (vendor/ is not committed), so bumping the lockfile is the fix.

- guzzlehttp/guzzle   7.10.0 -> 7.14.1 (dot-only cookie domains match all
  hosts; silent HTTPS-proxy downgrade to cleartext)
- guzzlehttp/psr7     2.8.0  -> 2.12.5 (CRLF injection in start-line
  serialization and via URI host; host confusion via authority reinterpretation)
- guzzlehttp/promises 2.3.0  -> 2.5.1  (required by guzzle >= 7.12)

composer audit now reports no advisories.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>