chore(deps): pull h2 up to 0.4.18 for RUSTSEC-2026-0258

h2 0.4.13 queued empty DATA frames without a limit, so memory could
grow unbounded. It reaches us only through mockito, a dev dependency,
so nothing in the shipped binary changes. The advisories gate passes
again.

The same lock update moves five crates from windows-sys 0.61.2 to
0.52.0. Both versions were already in the lock and neither target we
build compiles them.

Author: erickochen