fix: drop polonius-the-crab, inline unsafe reborrow (RUSTSEC-2024-0436) - #422

…436)

Drop polonius-the-crab and the chain of unmaintained crates underneath
it. The borrow-check trick polonius wrapped behind a macro is replaced
with a documented inline raw-pointer reborrow in `RowCursor::poll_next`
and `Next::poll` (the latter already used the same pattern upstream
post-PR-ClickHouse#397, so this PR completes the migration).

Why now

`paste`, the transitive dependency that polonius-the-crab uses, was
flagged as unmaintained by RUSTSEC-2024-0436. polonius-the-crab itself
has had no meaningful commits in 12+ months. The advisory + the four-
stagnant-crate dependency stack is a poor trade for a macro that
expands to one line of `unsafe { &mut *(bytes as *mut BytesExt) }`.

What changes

  - `Cargo.toml`: drop polonius-the-crab and the three transitive deps
    (paste, higher-kinded-types, macro_rules_attribute).
  - `src/cursors/row.rs`: replace the `polonius!()` macro in
    `RowCursor::poll_next` with the same raw-pointer reborrow already
    in use in `Next::poll`. Existing upstream features (tracing span
    enter, returned_rows counter, debug log on deserialize error) are
    preserved.
  - `src/cursors/row.rs`: extensive SAFETY comment documenting why the
    reborrow is sound (Ok / NotEnoughData / Err arms) and why each
    safer alternative (TryRow enum, async-only API, UnsafeCell,
    double-deserialise) was rejected. Once Polonius lands in stable
    rustc, the reborrow can be removed.
  - `rustfmt.toml`: bump `edition` 2021 -> 2024 to match `Cargo.toml`.
  - `tests/it/cursor_reborrow.rs` (new): 4 mock-based tests covering
    single row, multi-row, empty result, fetch_all/fetch_one; plus 3
    integration tests covering large results spanning chunks, borrowed
    rows, and small block size.

Verification

  - `cargo build --no-default-features` clean.
  - `cargo test --features test-util --test it cursor_reborrow` runs
    7 tests; the 4 mock-based pass without network. The 3 integration
    tests need a live ClickHouse to connect to.
  - The unsafe reborrow pattern in the new `poll_next` is the same one
    already in use in `Next::poll` upstream, so reviewers comparing
    the two will see identical structure.