Release 4.7.3

[benoitc]

Bundles everything merged since 4.7.2 and refreshes dependencies.

Fixed

• Pooled H2/H3 checkout get_state probe guard (connect_pool: unguarded hackney_conn:get_state/1 crashes checkout when a pooled HTTP/2/3 connection terminates mid-call #914/Guard get_state liveness probe during pooled H2/H3 checkout (#914) #915)
• normalize/2 rejects IDNA dot-variant hosts that fold to IP literals (Reject IDNA dot-variant hosts that normalize to IP literals #920)
• CONNECT proxy rejects CR/LF/NUL in the target host (Reject CR/LF/NUL in the CONNECT proxy target host #921)
• Pooled TLS upgrade bounded by connect_timeout (Bound the pooled TLS upgrade handshake with connect_timeout #922)
• Streaming request header sanitize + method validation (Validate request method and sanitize streaming request headers #924)
• Dead-end unpooled connections stop instead of leaking; get/set_location noproc-safe (hackney_conn leak: a body truncated by the peer parks an unpooled connection in closed forever (bypasses #903's finish_sync_request/3) #918/Stop dead-end connections instead of parking them in closed (#918) #919)

Changed

• curl-style Content-Length: 0 for empty POST/PUT/PATCH bodies (Always add Content-Length: 0 even for empty bodies #917/Send Content-Length: 0 for empty POST/PUT/PATCH bodies #925)
• Dependencies: quic 1.8.0, webtransport 0.4.4, mimerl 1.5.0, cowboy 2.18.0 (test)

Version bumped to 4.7.3 in NEWS.md and hackney.app.src.