v0.2.7

CI-only release. No behavioral changes to the library or CLI.

Changed

• ci: the release workflow's workflow_dispatch trigger no longer
  takes a tag input; dispatch it from the tag ref instead
  (gh workflow run release.yml --ref <tag>). Checking out an
  input-supplied ref under main's cache scope was a cache-poisoning
  path flagged by CodeQL.
• ci: CodeQL no longer analyses test code (tests/, spec/,
  src/**/tests.rs), which produced line-unstable
  rust/cleartext-logging false positives. url's unit tests moved to
  src/url/tests.rs so the exclusion can match them by path.