v1.1.5: merge upstream safety fixes + Telegram default = file + link only (#60)

Contains the three safety fixes from PRs #48/#49/#50 and the Persian
README RTL polishing from #58, all squashed into main. Merge details
already in their individual PR comments; summary:

  #48: reject truncated Content-Length relay responses (previously
       silently accepted whatever bytes arrived before EOF)
  #49: reject truncated or malformed (missing CRLF) chunked-encoding
       relay responses (same class of silent-acceptance bug)
  #50: restrict the SNI-rewrite tunnel dispatch to port 443. Plain
       HTTP (:80) targets that happened to match google.com / hosts
       override were being steered into the TLS tunnel and blocking
       waiting for a ClientHello that would never arrive.
  #58: trailing-whitespace line-breaks on Persian bullet lists in
       README so the RTL rendering doesn't collapse consecutive
       items into a single paragraph.

Test suite grew from 54 to 58 passing (three new negative tests for
the relay-reader correctness fixes + one SNI-rewrite port filter).

Telegram CI notify default switched to file-plus-link:
  - script gains a `--with-changelog` flag; default OFF
  - workflow only passes it when `vars.TELEGRAM_INCLUDE_CHANGELOG=true`
  - every routine release now posts just the APK + short caption
    (title + SHA-256 + repo URL + release URL) with no long body

To include bullets for a given release again:
  gh variable set TELEGRAM_INCLUDE_CHANGELOG --body true
The existing `vars.TELEGRAM_NOTIFY_ENABLED` job-level gate remains —
changelog toggle is orthogonal to enable/disable.

Also closes PR #55 without merging; ads/analytics domains were being
lumped under a YouTube-specific toggle, and the PR committed per-
machine \`.cargo/config.toml\` + zig-cc cross-compile helpers that
would have broken CI on actual Windows / macOS runners.

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "mhrv-rs"
-version = "1.1.4"
+version = "1.1.5"
 edition = "2021"
 description = "Rust port of MasterHttpRelayVPN -- DPI bypass via Google Apps Script relay with domain fronting"
 license = "MIT"