v0.10.0 - Hardening the relay and the storage layer

Maintenance release: hardening of the relay and of the DHT storage layer (designed as waves V0.9.10 and V0.9.11). First release whose version number simply counts releases in the order they ship; see "Releases and version numbers" in docs/roadmap.adoc.

Please update: memory-exhaustion bug in the lookup layer

Any peer connected to a node could send a crafted Kademlia lookup request that made the node try to allocate up to about 2 GiB per request on its network thread. The defect existed since v0.1.0 and was exposed by the browser node. Requests are now validated before anything is allocated.

Storage layer (V0.9.11)

• Absolute deadlines and concurrency caps for provider lookup, announcement and fetch.
• Bounded provider store (about 16 MiB at most). A peer using many identities can still crowd the eight provider slots of one content key; documented residual risk.
• Peer addresses learned from the DHT are sanitized (per-peer and per-IP caps, no DNS forms, public-only in WAN mode).
• Streams opened during lookups are closed; a Bitswap want-leak across peers is closed.

Relay (V0.9.10)

• Per-circuit stall limit (30 s) and per-connection stall budget (60 s per 10 min beyond a 1 s grace): a peer that stops reading no longer freezes the other circuits on the shared connection.
• A relayed connection the peer already opened is reused instead of dialling a second one.

Not changed / known limits

• The stall is bounded, not eliminated; the budget belongs to the connection, not to the peer that caused the stall.
• Messaging modules still use GossipSub for discovery; migration to the repaired DHT path is a separate step.
• Relays are chosen explicitly; no relay reputation yet.
• Known flaky test: CircuitProxyBackpressureTest "the same slow reader IS cut off once the grace is switched off" (failed in 2 of 5 runs; cause not established).

No binary artifacts are attached to this release; build from the tag with ./gradlew clean check.