xh: download ældre versioner

Security fixes
- Upgrade rustls-webpki to v0.103.16 and webpki-root-certs to v1.0.10
Features
- Detect and error on incomplete downloads, see #487 (@AkshayDhola)

Bug fixes
- Fix --auth ignoring credentials when the username is empty (e.g. -a :password), see #467 (@upuddu)
- Decode all frames in concatenated zstd response bodies, see #470 (@snowyukitty)

Features
- Pretty-print XML responses, see #450 (@o1x3)
- Add experimental HTTP message signatures (RFC 9421) support, see #448 (@zuisong)
Other
- Upgrade to reqwest v0.13, see #441 (@ducaale)

Features
- Add colors to --help/-h, see #432 (@starsep)
Bug fixes
- Don't fail on error code 416 if resuming download, see #434 (@simonomi)
Other
- Upgrade brotli to latest version, see #438 (@ducaale)

Features
- Add --unix-socket for calling Unix Domain Sockets, see #427 (@ducaale)
- Support binding to interface name on macOS, see #421 (@ducaale)
- Add experimental HTTP/3 support, see #425 (@ducaale)

Features
- Support RFC 5987 encoding for Content-Disposition filenames, see #416 (@zuisong)
Bug fixes
- Fix crash on empty zstd response body, see #411 (@blyxxyz)
Other
- Improve rustls errors for invalid certificates, see #413 (@blyxxyz)

Features
- Add --generate option to generate the man page and shell completions at runtime, see #393 (@fgimian)
- Add support for Elvish and Nushell shell completions, see #393 (@fgimian)
- Add --compress for compressing request body, see #403 (@zuisong)
Bug fixes
- Store default paths for cookies without an explicit path attribute, see #401 (@otaconix)
Other
- Support generating man page with reproducible timestamp via SOURCE_DATE_EPOCH, see #402 (@nc7s)
- Upgrade cookie_store to 0.21.1, see #397 (@kranurag7)

Security fixes
- Upgrade to ruzstd v0.7.3 to fix RUSTSEC-2024-0400, see #396 (@zuisong)
Bug fixes
- Warn on combination of --continue and Range header, #394 (@blyxxyz)
Other
- Enable logging in rustls and tracing-using dependencies, see #390 (@blyxxyz)

Features
- Handle responses compressed in zstd format, see #364 (@zuisong)
- Suppress warnings when -qq flag is used, see #371 (@blyxxyz)
- Add --debug option for logging and backtraces, see #371 (@blyxxyz)
- Decode content-disposition and location headers as UTF-8, see #375 (@zuisong)
- Print headers as latin1, with the UTF-8 decoding also shown if applicable, see #377 (@blyxxyz)
- Print the actual reason phrase sent by the server instead of guessing it from the status code, see #377 (@blyxxyz)
Bug fixes
- Apply TLS options to non-HTTPS URLs, see #372 (@blyxxyz)
Other
- Ignore NO_COLOR if set to empty string, see #370 (@blyxxyz)

Security fixes
- Prevent directory traversal in server-supplied filenames, see #379 (@blyxxyz)

Features
- Support http2-prior-knowledge, see #356 (@zuisong)
- Directly bind to interface name on supported platforms, see #359 (@ducaale)
- Enable stream when content-type is text/event-stream, see #360 (@zuisong)
- Decode utf-8 encoded string when formatting non-streaming JSON response, see #361 (@zuisong)
Other
- Upgrade to hyper v1, see #357 (@zuisong)
- Use serde-transcode to optimize JSON formatting, see #362 (@blyxxyz)

Features
- Add --resolve for overriding DNS resolution, see #327 (@ducaale)