Cram v1.3.0

Changed

• The vendored sevenz-rust2 fork is gone. Cram depended on sevenz-rust2-cram, a published
  copy of upstream 0.21.3 carrying two additions it needed: preparing a solid block off the writer
  thread, and an accessor for a coder's properties. Both were offered upstream, reviewed, and
  merged; upstream shipped them in 0.22.0. Cram now depends on plain sevenz-rust2 0.22 and the
  fork is retired.

  Dropping four upstream releases in one step also picks up fixes the fork never had. The one worth
  naming: coder stream counts read from a 7z block header are attacker-controlled and were summed
  without an overflow check, so a malformed archive could wrap past the bound that limits them.
  Cram reads archives it did not create, so this was reachable. Upstream fixed it in 0.21.4;
  the fork was pinned below that. Also included are a PPMd memory-limit check that compared bytes
  against a kilobyte limit (0.22.1), and batched AES-CBC decryption for encrypted .7z (0.21.5).

• lzma-rust2 0.16 → 0.20 and lz4_flex 0.13 → 0.14, which is what keeps one copy of each in the
  build now that sevenz-rust2 0.22 has moved. cram-extract was pinned to lzma-rust2 0.16
  separately and is bumped with it, so the standalone decoder and cram no longer ship different
  versions of the same XZ decoder.

No flag changed, no .cram archive reads differently, and nothing in the CLI moved.

Full Changelog: v1.2.0...v1.3.0