deps: bump pion/webrtc to v4.2.11, migrate transport v3 → v4

[myleshorton]

Summary

Bumps `pion/webrtc` from v4.1.2 → v4.2.11 and migrates the three clientcore files that reference `pion/transport` directly from v3 → v4 (pion switched its internal plumbing in v4.2.x).

Why now

Unbounded has no production clients yet, so this is the cheapest moment to land the migration. Widgets don't auto-update, so users on early widgets would be permanently stranded on whatever pion version we ship. Landing v4.2.x now means future pion updates (notably DTLS 1.3 once pion finishes it) apply uniformly to every widget we deploy from here on.

What's in pion v4.2.x

• SCTP RACK — claimed 71% throughput improvement, 27% latency reduction (see pion blog)
• ICE renomination — lets us re-select candidates without tearing down the connection
• pion/dtls v3.1.2 — DTLS 1.3 handshake components landing (PSK, signature algorithms, `signature_algorithms_cert` extension). Still work-in-progress per its own source: `"Only DTLS 1.2 is currently supported"` — not yet a shipping 1.3 implementation, but future-proof.
• Numerous bug fixes, including sanity fixes in srtp and sdp

Compatibility

DTLS has explicit version negotiation (old peer + new peer → negotiate the minimum). The `transport/v3 → v4` switch is purely internal dialer plumbing — socket-level, not on the wire. So this bump is not wire-breaking between old and new widgets/consumers.

Changes

• `clientcore/webrtc_api.go`, `clientcore/webrtc_api_js.go`, `clientcore/settings.go` — import `pion/transport/v4` instead of v3. `WebRTCOptions.Net`'s type silently changes from `transport/v3.Net` to `transport/v4.Net`; the interface is identical modulo the package path.
• `go.mod` / `go.sum` — the usual dep cascade

Downstream migration

lantern-box has one file that implements `transport.Net` (`protocol/unbounded/net.go`'s `rtcNet`). That's migrated in lantern-box PR #241 and TestUnboundedE2E passes with this broflake branch pinned in.

Test plan

• `go build ./...` passes
• `go test ./...` passes
• lantern-box's TestUnboundedE2E passes end-to-end with this branch pinned (full chain: sing-box consumer → unbounded outbound → broflake consumer → WebRTC → broflake widget → QUIC/WS → egress SOCKS5 → upstream)

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates the project’s WebRTC stack by bumping pion/webrtc to v4.2.11 and migrating direct pion/transport usage from v3 to v4 to match upstream’s updated internal plumbing.

Changes:

• Bump github.com/pion/webrtc/v4 from v4.1.2 to v4.2.11.
• Migrate clientcore imports from github.com/pion/transport/v3 to github.com/pion/transport/v4 (including stdnet).
• Update module metadata and dependency graph in go.mod / go.sum (including Go version directive).

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
go.mod	Updates Go version directive and bumps pion/webrtc + migrates pion/transport to v4; refreshes indirect deps.
go.sum	Updates checksums to reflect the new dependency versions pulled by the bump/migration.
clientcore/webrtc_api.go	Switches non-wasm WebRTC API plumbing to use transport/v4 and stdnet from v4.
clientcore/webrtc_api_js.go	Switches wasm build transport import to transport/v4.
clientcore/settings.go	Updates exported WebRTCOptions.Net type to transport/v4.Net.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.