Update crates flagged by RustSec to their newest semver-compatible
releases with `cargo update -p <crate>@<version> --precise <version>`:
  crossbeam-epoch 0.9.18 -> 0.9.21 (RUSTSEC-2026-0204)
  h2 0.4.14 -> 0.4.19 (RUSTSEC-2026-0258)
The windows-sys entries cargo rewrote alongside are left out; they apply
to Windows targets only.

--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1743,9 +1743,9 @@
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "dc74980687109a3b14c72fd458107bf0baa1da1a1a805e178d15501ba9b86d9d"
 dependencies = [
  "crossbeam-utils",
 ]
@@ -3222,9 +3222,9 @@
 
 [[package]]
 name = "h2"
-version = "0.4.14"
+version = "0.4.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "171fefbc92fe4a4de27e0698d6a5b392d6a0e333506bc49133760b3bcf948733"
+checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -3520,7 +3520,7 @@
  "bytes",
  "futures-channel",
  "futures-core",
- "h2 0.4.14",
+ "h2 0.4.19",
  "http 1.5.0",
  "http-body",
  "httparse",
@@ -6621,7 +6621,7 @@
  "futures-channel",
  "futures-core",
  "futures-util",
- "h2 0.4.14",
+ "h2 0.4.19",
  "http 1.5.0",
  "http-body",
  "http-body-util",
@@ -8372,7 +8372,7 @@
  "base64 0.22.1",
  "bytes",
  "flate2",
- "h2 0.4.14",
+ "h2 0.4.19",
  "http 1.5.0",
  "http-body",
  "http-body-util",