rust-gvm 0.10.0

rust-gvm v0.10.0

rust-gvm v0.10.0 adds capability-gated, exact-byte GMP response streaming and
the first bounded streaming integration for native XML report pages. It also
adds typed semantic views of GMP server errors and feed synchronization state
while preserving the original protocol status, text, and wire values.

Callers upgrading from v0.9.0 should review the
v0.10.0 migration guide.
GmpRequestError is no longer Copy, streamed response failures invalidate
the connection unless the complete frame validates, and report-page traversal
must advance by the actual returned result count rather than the requested or
server-reported window size.

Highlights:

• generic GmpClient::execute_stream and execute_stream_with operations,
  statically gated by GmpStreamingResponse;
• exact response bytes with caller-driven backpressure, explicit completion,
  AsyncWrite copying, and deterministic connection lifecycle semantics;
• independent total-byte, retained-token, idle-timeout, and total-timeout
  policies for streamed responses;
• incremental XML framing that validates the root status before yielding bytes
  and supplies bounded, path-selected events to typed decoders;
• GetNativeReportPageRequest and NativeReportPageResponse for explicit,
  validated report windows with small completion metadata;
• continuation metadata based on the number of direct results actually
  returned, including safe handling of server page caps and empty pages;
• source-preserving GmpRequestError::FilterFragment diagnostics;
• shared GmpServerErrorKind classification and matching parser/client error
  accessors while retaining raw GMP status and status text;
• raw-preserving FeedSyncState semantics for missing, inactive, active, and
  unsupported feed synchronization wire forms;
• stricter XML character-reference validation that rejects signed and other
  non-XML lexical spellings;
• pageant 0.2.5, which bounds peer-controlled frames before buffering and
  fixes CVE-2026-116775's remote memory-exhaustion denial of service;
• reviewed dependency refreshes and Cargo Vet evidence;
• release binaries for five targets, each with a SHA-256 checksum;
• the Linux amd64/arm64 mock-server image at
  ghcr.io/greenbone-hive/gvm-mock-server:v0.10.0 (no moving latest tag);
• CycloneDX JSON and XML SBOMs, an SBOM quality report, checksums, and Sigstore
  provenance for downloadable artifacts and the container image.

The release artifacts are built from the immutable v0.10.0 tag and verified
against its exact qualified protected-main commit before publication completes.