v1.0.2

Security fixes, from a review of the whole plugin after two rounds of marketplace review.

• Both process streams are capped at the producer, not only stdout. cdctl reports failures as a
  JSON envelope on stderr, so the two are bounded separately rather than merged.
• Every Text states Text.PlainText. The default is Text.AutoText, which reads anything
  tag-shaped as rich text, so a looked-up name carrying markup was rendered as markup.
• The analytics region must look like a name. It decides the request host, and a / in it ended
  the authority and sent the API token elsewhere.
• Analytics requests no longer follow redirects, which urllib follows while re-sending the
  Authorization header, including to another host and to plain http.
• -- ends option parsing before every hostname, so a name beginning with a dash is a host and
  not a flag, and hostnames from the activity log are validated like typed ones.
• Row counts asked of the API are enforced where they are read, rather than trusted.

CI now checks the two invariants qmllint cannot express: a Text without an explicit format, and
a command that would run unbounded.