fix(file): keep image holes and map ext4 journals in bmaps

[JanZachmann]

Summary

• write_partition compares the partition file with the image in 4 KiB blocks and writes only the blocks that differ, instead of running fallocate -d. fallocate is removed from the Docker image.
• The image is copied with copy_image, which keeps the holes (found by libfs with use_linux) and copies each data segment in a loop. Decompressing an image keeps zero blocks as holes.
• Before bmaptool create, the journal blocks of every ext4 partition are rewritten with their own content, so the bmap maps the journals. This code lives in the new file::bmap module. debugfs lists the journal blocks, so the package and the Docker builder need e2fsprogs.
• All direct dependencies are bumped to their latest version, including major versions. omnect-crypto 0.5.0 drops the unused extensions argument of create_cert_and_key. actix-web runs without default features, and flate2 sets rust_backend itself.

Reason

A fresh ext4 journal is all zeros. In a sparse image, e.g. one that xz decompressed into a file, or one after fallocate -d, these zeros are holes, and a bmap skips them. A bmap-based flash then leaves the journal of the previous installation on the device, and after a power cut its replay can apply an old transaction to the new filesystem. Rewriting the journal blocks allocates the holes and leaves every other block as it is; for an omnect image this adds the cert, etc and data journals to the flash. This replaces the image-side approach discussed in omnect/meta-omnect#701: the Yocto build already maps the journals, and they are lost only when the image is decompressed sparse.

With default-features = false, libfs made byte copies, so every image came back fully allocated, and the decompress wrote zero blocks as data. fallocate -d hid both; without it, every bmap would map the whole image. libfs::copy_file is not used because it copies each data segment with a single copy_file_range call, which moves at most 2 GiB, and ignores a short copy.

Writing only changed blocks also fixes a gap of the old dd conv=notrunc,sparse: a block that changed to all zeros was skipped and kept its old content; now it is written because it differs.

actix-web's default http2 feature pulled in h2 0.3.27 (RUSTSEC-2026-0258), which has no fixed 0.3 release. The OAuth callback server serves only plain HTTP on localhost, so it never uses HTTP/2. flate2 got its zlib backend only through actix-web's compression features. For a certificate without CSR, omnect-crypto 0.5.0 adds the same extensions as 0.4.0.