[branch-55] chore: update version to 55.3.0 and add changelog - #27388

## Which issue does this PR close?

- Part of #26868 (55.3.0 release)

## Rationale for this change

`cargo audit` is failing on `branch-55` (for example on #27388) with 15
vulnerabilities across 7 crates:

- `ctutils` 0.4.2:
[RUSTSEC-2026-0385](https://rustsec.org/advisories/RUSTSEC-2026-0385)
- `quinn-proto` 0.11.15:
[RUSTSEC-2026-0338](https://rustsec.org/advisories/RUSTSEC-2026-0338),
[RUSTSEC-2026-0339](https://rustsec.org/advisories/RUSTSEC-2026-0339),
[RUSTSEC-2026-0340](https://rustsec.org/advisories/RUSTSEC-2026-0340),
[RUSTSEC-2026-0341](https://rustsec.org/advisories/RUSTSEC-2026-0341),
[RUSTSEC-2026-0342](https://rustsec.org/advisories/RUSTSEC-2026-0342)
- `rustls` 0.23.45:
[RUSTSEC-2026-0346](https://rustsec.org/advisories/RUSTSEC-2026-0346),
[RUSTSEC-2026-0347](https://rustsec.org/advisories/RUSTSEC-2026-0347),
[RUSTSEC-2026-0348](https://rustsec.org/advisories/RUSTSEC-2026-0348),
[RUSTSEC-2026-0349](https://rustsec.org/advisories/RUSTSEC-2026-0349)
- `rustls-webpki` 0.103.15:
[RUSTSEC-2026-0382](https://rustsec.org/advisories/RUSTSEC-2026-0382)
- `zstd` 0.13.3:
[RUSTSEC-2026-0391](https://rustsec.org/advisories/RUSTSEC-2026-0391)
- `zstd-safe` 7.2.4:
[RUSTSEC-2026-0398](https://rustsec.org/advisories/RUSTSEC-2026-0398),
[RUSTSEC-2026-0403](https://rustsec.org/advisories/RUSTSEC-2026-0403)
- `zstd-sys` 2.0.16:
[RUSTSEC-2026-0410](https://rustsec.org/advisories/RUSTSEC-2026-0410)

This follows the model of similar fixes on earlier maintenance branches:

- #23607 (branch-54)
- #21587 (branch-53)
- #21415 (branch-52)

## What changes are included in this PR?

`Cargo.lock` only, from

```shell
cargo update -p ctutils -p quinn-proto -p rustls -p rustls-webpki -p zstd -p zstd-safe -p zstd-sys
```

| Crate           | Before | After   |
| --------------- | ------ | ------- |
| `ctutils`       | 0.4.2  | 0.4.8   |
| `quinn-proto`   | 0.11.15 | 0.11.19 |
| `rustls`        | 0.23.45 | 0.23.46 |
| `rustls-webpki` | 0.103.15 | 0.103.17 |
| `zstd`          | 0.13.3 | 0.13.5  |
| `zstd-safe`     | 7.2.4  | 7.4.1   |
| `zstd-sys`      | 2.0.16 | 2.1.3   |

`quinn-proto` 0.11.19 adds `rand_pcg` 0.10.2 as a new transitive
dependency. All updates are semver compatible, so no `Cargo.toml`
changes are needed, and no new advisories are ignored.

## Are these changes tested?

Yes, by CI. Locally, `cargo audit --ignore RUSTSEC-2026-0194 --ignore
RUSTSEC-2026-0195` (the command CI runs on this branch) now passes with
only allowed warnings remaining.

## Are there any user-facing changes?

No, dependency version bumps in `Cargo.lock` only.

Co-authored-by: Claude Fable 5.2 <[email protected]>

…t (backport #27407) (#27408)

## Which issue does this PR close?

- part of #26868
- Backport of #27407 to `branch-55` (only `quinn-udp` needs updating
here, `quinn-proto` is already 0.11.19)
- Related to #27431 and to #27388, where the security audit is failing.

Co-authored-by: Claude Fable 5.2 <[email protected]>

…t (backport #27407) (#27409)

## Which issue does this PR close?

- part of #23805
- Backport of #27407 to `branch-54`
- Related to #27431 and to #27388, where the security audit is failing.

Co-authored-by: Claude Fable 5.2 <[email protected]>

)

## Which issue does this PR close?

- Closes apache#27431.
- Related to apache#27388, where the security audit is failing.

## Rationale for this change

`cargo audit` fails against the current `Cargo.lock` on `main` with 3
vulnerabilities from advisories published after the last audit run:

- `quinn-proto` 0.11.18:
[RUSTSEC-2026-0523](https://rustsec.org/advisories/RUSTSEC-2026-0523),
[RUSTSEC-2026-0524](https://rustsec.org/advisories/RUSTSEC-2026-0524)
- `quinn-udp` 0.5.14:
[RUSTSEC-2026-0538](https://rustsec.org/advisories/RUSTSEC-2026-0538)

The same advisories are failing the `security_audit` check on
`branch-54` and `branch-55`.

## What changes are included in this PR?

`Cargo.lock` only, from

```shell
cargo update -p quinn-udp -p quinn-proto
```

| Crate         | Before  | After   |
| ------------- | ------- | ------- |
| `quinn-proto` | 0.11.18 | 0.11.19 |
| `quinn-udp`   | 0.5.14  | 0.5.16  |

Both updates are semver compatible, so no `Cargo.toml` changes are
needed, and no new advisories are ignored.

## What is the testing strategy for this PR?

Covered by the `security_audit` CI job. Locally, `cargo audit` now
passes with only allowed warnings remaining.

## Are there any user-facing changes?

No, dependency version bumps in `Cargo.lock` only.

Co-authored-by: Claude Fable 5.2 <[email protected]>