lz4-java v1.11.4

Security release for GHSA-gm45-99xc-r7wv, GHSA-343h-94h5-c4wr and GHSA-mcr4-qmvw-px4g. Also includes general fixes for bugs found by AI.

What's Changed

• Update astral-sh/setup-uv action to v10.2.0 by @renovate[bot] in #97
• Update dependency com.carrotsearch.randomizedtesting:randomizedtesting-runner to v2.9.2 by @renovate[bot] in #98
• Update cloudflare/wrangler-action digest to 953926a by @renovate[bot] in #99
• Fix NPE in LZ4FrameInputStream on skippable-only streams by @yawkat in #125
• Release source critical array before throwing OOM in LZ4JNI by @yawkat in #124
• Fix stale OutOfMemoryError reference in XXHashJNI by @yawkat in #127
• Reject truncated block header in LZ4BlockInputStream by @yawkat in #128
• Don't restore the Maven cache in the release workflow by @yawkat in #132
• Read skippable frame size as unsigned in LZ4FrameInputStream by @yawkat in #131
• Only run test workflow on push to main by @yawkat in #136
• Document CPU cost of high HC compression levels by @yawkat in #141
• Fix int overflow in streaming XXHash update buffering check by @yawkat in #138
• docs: declare requires-python >= 3.12 in justfile scripts by @yawkat in #130
• Make docs manual-dispatch deploy branch explicit by @yawkat in #137
• Switch Maven wrapper to script-only and use strict checksums in CI by @yawkat in #144
• Verify SHA-256 of lz4 CLI downloaded in Windows release job by @yawkat in #134
• docs: validate version input and tag names before interpolating them by @yawkat in #142
• Test safe decompressors with destination offsets and buffer kinds by @yawkat in #146
• Document that StreamingXXHash32.asChecksum() returns only 28 bits by @yawkat in #140
• Declare explicit GITHUB_TOKEN permissions in workflows by @yawkat in #135
• Only publish to Central from v* tags by @yawkat in #139
• Test the darwin/aarch64 native library before publishing by @yawkat in #143
• Fix negative LZ4BlockInputStream.available() after an empty block by @yawkat in #129
• Delete .clinerules by @yawkat in #148
• Rework README, add contributing guide, Scorecard and coverage by @yawkat in #147
• Fix test compilation on main: remove duplicate testAvailableAfterEmptyBlock by @yawkat in #149

Full Changelog: v1.11.3...v1.11.4