0.6.0 — audit-driven security and concurrency hardening

Security + concurrency hardening pass from a multi-agent audit. Bundles eight PRs (#2-#10).

Headlines

• Critical: CONTINUATION-flood byte cap, controlling_process owner monitor.
• High: send_frame error propagation, HPACK table cap, send-buffer cap, set_stream_handler default flip, handle_send_data yielding, acceptor EXIT mailbox drain, TLS server hardening.
• Medium: default max_concurrent_streams = 100, logger:error/2 migration, setting_id dedup, SETTINGS_ACK state preservation, safe_path hardening, cancel_stream deprecation.
• Low/Info: set_active error handling, peel_reason recursive, cancel_timer flush, =:= consistency, ?DEFAULT_TIMEOUT_MS constant.

Breaking notes

• set_stream_handler/3,4 default flipped (drain_buffer => false); the connection replays buffered DATA frames itself.
• send_data/3,4 may return {error, send_buffer_full} when the peer stalls its receive window.
• cancel_stream/2,3 is -deprecated; use cancel/2,3.
• Default SETTINGS_MAX_CONCURRENT_STREAMS = 100 (was unlimited).
• TLS server: verify_peer without cacerts now fails fast with {error, verify_peer_requires_cacerts}.

Full changelog: https://github.com/benoitc/erlang_h2/blob/0.6.0/CHANGELOG.md