feat: upgrade object_store to 0.14, reqwest to 0.13, unpin worker

[alukach]

What I'm changing

object_store 0.13 held the whole dependency tree back: it required reqwest 0.12 (wasm-streams 0.4), which conflicted with worker 0.7.5+ (wasm-streams 0.5), forcing the worker = "=0.7.4" pin and blocking worker-build 0.8. object_store 0.14 moves to reqwest 0.13, so this PR takes all three interlocked bumps together: object_store 0.14, reqwest 0.13, and worker unpinned to 0.7.5+.

The catch: object_store 0.14's aws/azure/gcp meta-features now hard-wire the aws-lc-rs crypto provider, which does not build on wasm32 — its build script demands a backend feature that only reqwest's native-only rustls stack enables. This PR switches to the upstream-documented composable features so the wasm32 (Cloudflare Workers) target keeps building.

How I did it

• Workspace Cargo.toml: object_store 0.14 with aws-base + reqwest + ring instead of aws — ring provides signing on all targets including wasm32, and keeps aws-lc-rs out of the wasm graph. reqwest bumped to 0.13.2 (first release on wasm-streams 0.5) with rustls-tls renamed to rustls per reqwest 0.13. worker unpinned from =0.7.4 to 0.7.5; the old tracking comment (Pluggable Crypto / Update reqwest 0.13 apache/arrow-rs-object-store#707) is resolved by this PR.
• crates/core: azure/gcp passthrough features now map to object_store's azure-base/gcp-base (the full variants pull aws-lc-rs and break wasm). Added a direct reqwest dep — not used by code, it guarantees reqwest's rustls TLS backend is enabled for object_store's built-in transport when multistore is built standalone; without it object_store's client code fails to compile (this is what upstream's meta-features did via reqwest/rustls).
• crates/core/src/api/list.rs: ListResult gained an extensions field in 0.14; test fixtures populate it with Default::default().
• crates/cf-workers / examples/cf-workers: added a getrandom 0.4 wasm_js shim alongside the existing v0.2/v0.3 ones (object_store 0.14 pulls rand 0.10 → getrandom 0.4), and enabled ring/wasm32_unknown_unknown_js so ring-based signing has a randomness backend on wasm32.
• examples/*: reqwest 0.13 split .form() into an opt-in form feature; enabled it in the three example crates that call it.
• CI / wrangler configs / docs: refreshed the worker-build ^0.7 comments that referenced the removed =0.7.4 pin. worker 0.8 + worker-build 0.8 are now unblocked, but that's a separate breaking upgrade.

Test plan

• cargo check (workspace) and cargo check -p multistore standalone, with and without --features azure,gcp
• cargo check -p multistore-cf-workers --target wasm32-unknown-unknown, with and without --features azure,gcp, plus -p multistore-cf-workers-example
• cargo test — 222 tests pass
• cargo clippy clean, cargo fmt
• Live smoke test: native multistore-server against seeded MinIO (docker compose) — anonymous GET/HEAD via presigned backend URLs and ListObjectsV2 through object_store's reqwest transport all return correct results, exercising the new ring signing path

🤖 Generated with Claude Code