Bump up the version to 1.4.3

- New FetchDownloadSourceUrl module POSTs to /binary/api/v1/endpoint to
  discover the current CDN base URL (CloudFront primary; CloudFlare
  requested as fallback via X-Local-Fallback-Cloudflare header on retry).
- Linux arm64 host now downloads BrowserStackLocal-linux-arm64. Branch
  order mirrors Node SDK: arm64 wins over alpine on musl.
- proxyHost/proxyPort from Local#start now also flow into the binary
  download (previously ignored for download, used only for running binary).
- User-Agent: browserstack-local-ruby/<version> on endpoint POST + GET.
- TLS verification now enforced (VERIFY_PEER); was VERIFY_NONE.
  CHANGELOG calls this out for users on broken trust stores.

Tracks LOC-6563.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Net::HTTP defaults to 60s open + 60s read. A hung
local.browserstack.com or CDN can stall the binary download for
multiple minutes before the user sees an error.

- fetch_download_source_url.rb: open_timeout=10, read_timeout=15
  (small JSON response, fast)
- localbinary.rb download_to: open_timeout=10, read_timeout=30
  (read_timeout bounds per-read stalls, not total transfer)

Code review finding from LOC-6563 review.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…rity

1.5.0: arm64 + dynamic CloudFront source URL (LOC-6563)

`gem push` fails since MFA was enabled on the RubyGems account —
the API-key flow can't supply an OTP from a non-interactive
runner. Trusted publishing is the supported replacement and is
already configured on rubygems.org for this gem (pointed at this
workflow file, no GitHub Environment binding).

Changes:
- Add `id-token: write` to job permissions (required for the
  GitHub OIDC token exchange).
- Remove unused `packages: write` permission (was for GitHub
  Packages, never wired up).
- Replace the manual credentials-file dance + `GEM_HOST_API_KEY`
  env var with `rubygems/configure-rubygems-credentials@v2.0.0`
  (same action `rubygems/release-gem@v1` calls internally —
  verified by reading its action.yml). Existing `gem build` +
  `gem push` then read credentials the action sets up.

No new secrets. `RUBYGEMS_AUTH_TOKEN` becomes obsolete and should
be deleted from repo Settings → Secrets after the first green
dispatch.

Tracks LOC-6563.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…blishing

CD: switch gem-push to RubyGems Trusted Publishing (OIDC)

Pin returntocorp/semgrep container image to a specific version
and GitHub Actions to major version tags to prevent :latest
tag resolution and reduce supply-chain attack surface.

Fixes: LCNC-15821

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>