Merge remote-tracking branch 'origin/develop' into audit-mix-audit-report

Conflict resolution notes:

- mix.lock: kept this branch's versions for cowlib, h2, hackney and hpax.
  Those upgrades are the point of the branch; develop is still on hackney
  1.20.1.

- .woodpecker/docker-armv7.yaml: accepted develop's deletion. It only
  existed here to build mdex_native on armv7, and mdex was already
  replaced with earmark again.

- lib/pleroma/reverse_proxy.ex: took develop's version. It independently
  grew request_with_constraints/5 and the invalid-status close, which
  supersede the equivalent fixes on this branch. Re-applied this branch's
  recv_timeout seeding, which develop does not have.

- lib/pleroma/gun/connection_pool/worker.ex and
  lib/pleroma/reverse_proxy/client/tesla.ex: took develop's versions. The
  gun pool rework (#7934) already guards the demonitor and makes
  release_conn/cancel_stream exit-safe, and it splits the Tesla client's
  graceful release from its abort path, so this branch's changes there are
  obsolete.

That leaves the client leak fix as a Hackney-only concern, which
stream_body/1 now handles the same way the gun client does.

mix.exs

@@ -15,6 +15,13 @@ defmodule Pleroma.Mixfile do
       aliases: aliases(),
       deps: deps(),
       test_coverage: [tool: :covertool, summary: true],
+      test_ignore_filters: [
+        "test/credo/check/consistency/file_location.ex",
+        "test/fixtures/config/temp.exported_from_db.secret.exs",
+        "test/fixtures/config/temp.secret.exs",
+        "test/fixtures/modules/good_mrf.ex",
+        "test/fixtures/modules/runtime_module.ex"
+      ],
       # Docs
       name: "Pleroma",
       homepage_url: "https://pleroma.social/",
@@ -147,8 +154,8 @@ defmodule Pleroma.Mixfile do
       {:cachex, "~> 3.6"},
       {:tesla, "~> 1.20.0"},
       {:castore, "~> 1.0"},
-      {:cowlib, "~> 2.15"},
-      {:gun, "~> 2.2"},
+      {:cowlib, "~> 2.17.1"},
+      {:gun, "~> 2.4.1"},
       {:finch, "~> 0.20"},
       {:jason, "~> 1.4"},
       {:mogrify, "~> 0.9.3", override: true},