Update sfio-rustls-config to 0.4.2

CHANGELOG.md

@@ -1,5 +1,4 @@
 ### 1.6.0 ###
-* :shield: rodbus is not affected by [GHSA-qwgh-2vcv-g2f7](https://github.com/advisories/GHSA-qwgh-2vcv-g2f7), which scanners report against `block-buffer` 0.10.4. The inline cursor the advisory describes doesn't exist in 0.10, and rodbus reaches `block-buffer` only when TLS decrypts a password-protected private key file. OSV-Scanner now ignores it with this reasoning. See [#354](https://github.com/stepfunc/rodbus/pull/354).
 
 ### 1.6.0-M3 ###
 * :bell: **License update.** The license now prohibits using the library, including its source, documentation, tests and binaries, to design, develop, specify, test or improve any other implementation of the protocol, whether commercial or open source, and reserves text and data mining, including AI training. AI-assisted evaluation and integration remain welcome. Coding agents get the policy from the new `AGENTS.md`. See [#224](https://github.com/stepfunc/rodbus/pull/224).

CLAUDE.md

@@ -30,7 +30,8 @@ written license terms and authorizations govern.
 - The `audit` (cargo-audit) and `osv-scanner` CI jobs fail when an advisory is published against a locked dependency, including on unrelated PRs. Check whether `main` is affected, then fix it in its own PR against `main` (usually `cargo update -p <crate>`) and rebase open PRs once it merges
 - The PR description must say whether rodbus, as configured, is exposed and why, citing the code that decides it. This analysis is what determines whether released versions need a patch or an announcement
 - To assess exposure, check what the released lockfiles (`git show <tag>:Cargo.lock`) pinned and how rodbus uses the affected code. For TLS: `sfio-rustls-config` builds the trust store from `RootCertStore::empty()` plus only the configured CA file (no system or `webpki-roots` certificates), `CertificateMode::AuthorityBased` uses the webpki verifiers against that store, and `CertificateMode::SelfSigned` rejects any intermediates and compares the peer certificate byte for byte without building a chain
-- Add a `:shield:` changelog entry naming the advisory and the exposure. Rust users pick up a fixed dependency on their next `cargo update`, so a lockfile update only changes the prebuilt bindings (C/C++, .NET, Java); say so
+- Add a `:shield:` changelog entry only when the advisory matters to users: Rust users in a realistic configuration, or users of the prebuilt bindings (C/C++, .NET, Java), which ship the locked version. Name the advisory and the exposure. Rust users pick up a fixed dependency on their next `cargo update`, so a lockfile update only changes the prebuilt bindings; say so. An advisory that affects no user gets no entry; the PR description records why
+- A lockfile update that adds crates to the bindings needs their licenses in `allowed.json`, which `bom-tools` checks only in the packaging job (tags, or `gh workflow run ci.yml --ref <branch>`)
 - If released versions are exposed in a realistic configuration, raise a patch release with the maintainer; otherwise the fix ships in the next release
 
 ## Code Style Guidelines