Security: fix low-severity findings (v0.11.8)

[mack42]

Addresses the Low findings from the security audit. Version bumped to 0.11.8. cargo check is clean (no warnings); 87 unit tests + all integration tests pass except the two pubsub integration tests in the untracked WIP tests/ dir that fail identically on main (pre-existing, unrelated).

Findings addressed

24. ACL WHOAMI hardcoded "default". Now answered in the connection layer and returns the actual authenticated username.

25. Channel ACLs never enforced. A user's channel_patterns are now checked on SUBSCRIBE/PSUBSCRIBE/PUBLISH (and the shard variants) via command_channels + is_channel_allowed, mirroring the key-ACL enforcement. The default user (&*) is unaffected.

26. Config Debug leaked plaintext requirepass. Replaced the derived Debug with a manual impl that redacts requirepass (shown as Some("***")), so it can't land in a {:?} log line.

28. Decompression-bomb shape in compression.rs. decompress() now validates both the header's declared length and the LZ4 stream's embedded size prefix against a 512 MB cap before decompressing. (Still no non-test callers, so this is defensive.)

29. Small robustness items.

• AOF replay duration_since(UNIX_EPOCH).unwrap() → unwrap_or_default() (no panic on a pre-1970 clock).
• ScriptCache/FunctionLibrary .lock().unwrap() → poison-recovering unwrap_or_else(|e| e.into_inner()).

Not changed (documented residuals)

• 27. Unsalted SHA-256 for ACL passwords — won't fix. This is mandated by Redis ACL wire compatibility: ACL SETUSER user #<sha256hex> and ACL GETUSER (which returns the hash) both assume unsalted SHA-256. Salting would break compatibility, which is a core project goal.
• rustls-pemfile unmaintained (RUSTSEC-2025-0134) — deferred. This is a maintenance advisory, not a vulnerability. The rustls-pki-types 1.14.0 already in the tree exposes no PEM API, so replacing it would require a broader upgrade of security-sensitive TLS parsing; not worth the risk for a Low.
• 29 (partial): SAVE/BGSAVE hardcode dump.rdb/appendonly.aof. Using the configured filename requires threading Config through CommandContext (touched by every handler); deferred as disproportionate for a Low that only matters when the operator renamed the file. The values still match the config defaults.
• 25 caveat: PSUBSCRIBE patterns are checked against the user's channel patterns with glob matching (approximate), not Redis's exact literal-pattern rule.

Adds command_channels and decompression-guard unit tests.