Support xmlsec1 1.3.13 and bundle it in all wheels (#435)

Fixes building and running python-xmlsec against xmlsec1 1.3.13 and bumps the
bundled xmlsec1 to 1.3.13 on all platforms (Linux, macOS, Windows). Closes #434.

## Backward-incompatible changes

xmlsec1 1.3.13 tightens several defaults. python-xmlsec follows the new library
defaults and does not restore the old behavior. Wheels bundle 1.3.13, so these
changes apply to everyone installing from wheels. Source builds behave
according to the libxmlsec1 version they link against.

### 1. Only empty and same-document reference URIs are allowed by default

`<dsig:Reference>` URIs are now limited to `URI=""` and `URI="#id"` by default.
Any other URI, e.g. `http://...`, `cid:...`, `file:///...` or a relative path
such as `other.xml`, makes `SignatureContext.sign()` / `verify()` raise
`xmlsec.Error`. This mostly affects code that resolves external references
through `xmlsec.register_callbacks`.

To opt in, set the new `SignatureContext.enabled_reference_uris` property:

    ctx = xmlsec.SignatureContext()
    ctx.enabled_reference_uris = (
        xmlsec.constants.TransformUriTypeEmpty
        | xmlsec.constants.TransformUriTypeSameDocument
        | xmlsec.constants.TransformUriTypeRemote
    )  # or xmlsec.constants.TransformUriTypeAny

### 2. External URIs are rejected in encryption and KeyInfo processing

The same default (empty + same-document only) now applies to:

- `<enc:CipherReference URI="...">` when decrypting with `EncryptionContext.decrypt()`
- `<dsig:RetrievalMethod URI="...">` and `<dsig11:KeyInfoReference URI="...">` in `<dsig:KeyInfo>`

python-xmlsec does not expose a setting to widen these, so documents that rely
on external URIs here can no longer be processed. `EncryptionContext.encrypt_uri()`
is not affected: xmlsec1 allows the URI passed by the caller.

### 3. Other behavior changes inherited from xmlsec1 1.3.13

These come from the library itself and have no python-xmlsec setting:

- **Relationship transform** (OOXML / OPC signatures): several handling bugs
  were fixed, so digests can differ from those produced by older versions.
- **PBKDF2**: iteration counts above 1,000,000 are rejected.
- **CBC decryption**: a padding length of zero is now rejected as invalid
  padding.
- **Nested key depth**: the `<enc:EncryptedKey>` nesting limit (default 1)
  now also counts `<enc11:DerivedKey>`, `<enc:AgreementMethod>` and
  `<as:EncapsulationMechanism>`.

See the xmlsec1 1.3.13 release notes for the full list:
https://www.aleksey.com/xmlsec/news.html

## New API

- `SignatureContext.enabled_reference_uris` (read/write `int`): bitmask of
  allowed `<dsig:Reference>` URI types. Raises `TypeError` for non-int or
  `del`, `OverflowError` for negative values, `ValueError` for values above
  `TransformUriTypeAny`.
- New constants: `xmlsec.constants.TransformUriTypeNone`, `TransformUriTypeEmpty`,
  `TransformUriTypeSameDocument`, `TransformUriTypeLocal`, `TransformUriTypeRemote`,
  `TransformUriTypeAny`.

## Compatibility fixes for xmlsec1 1.3.13

- Build: include `<xmlsec/dl.h>` explicitly. 1.3.13 no longer includes it
  transitively.
- `xmlsec.init()` called after import no longer fails. 1.3.13 rejects a
  second `xmlSecInit()` without a shutdown in between.
- Encrypting with an `<enc:EncryptedKey>` keeps lax key lookup for the key
  encryption key. 1.3.13 stopped copying the lax-search flag into the nested
  context that encrypts the session key.

## Build and packaging

- Bundled xmlsec1 1.3.12 → 1.3.13 on Linux/macOS (`build_support`, `cache_libs`
  workflow) and Windows (win-binaries release `2026.10.28`).
- Static xmlsec1 builds are configured with `--disable-apps` (1.3.13's fuzz
  targets fail to build against a private libxslt prefix) and `--with-pic`
  (1.3.13's hardening flags otherwise produce non-PIC objects that can't be
  linked into the extension module).

## Docs and tests

- Documented the new constants and `enabled_reference_uris`.
- Added tests for `enabled_reference_uris`. The `register_callbacks` test now
  opts into all URI types.

[pre-commit.ci] pre-commit autoupdate (#399)

updates:
- [github.com/astral-sh/ruff-pre-commit: v0.14.3 → v0.14.4](astral-sh/ruff-pre-commit@v0.14.3...v0.14.4)

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

Fix windows wheels and add ARM support (#354)

Co-authored-by: Tomi Belan <tomi.belan@gmail.com>

Merge pull request #340 from haya4ux/patch-1

Fix type mismatch in PyXmlSec_ClearReplacedNodes for Python 3.13 compatibility

Add windows wheel build (#313)

Merge pull request #300 from jonathangreen/feature/version-check-code…

…-review-updates

Update to libxml2 version incorporating code review feedback

* Add CI for Python 3.10, `manylinux2` SOABI, `musllinux1` SOABI and …

…OpenSUSE Tumbleweed

* Introduce linting with `pre-commit`
* Rewrite PEP 484 stubs
* xmlsec workaround for gh##84 - Stanislav Levin
* Resolve key loading issue on big-endian systems. - Chris MacNaughton
* Fix building wheel when using `PYXMLSEC_STATIC_DEPS=true`
* setup.py: Fix typo in PYXMLSEC_LIBXSLT_VERSION - AbdealiJK
* Switch on modern headers lxml - Alexander Shadchin
* use build to build wheels - Thomas Grainger
* remove pkgconfig as it's only a build-system requirement - Thomas Grainger
* exclude lxml 4.7 because the wheels are missing the lxml includes - Thomas Grainger

* Added support for registering custom xmlsec IO callbacks

* Added support for building without MD5 transforms
* Added support for PEP 539 for Python 3.7 and newer
* Using `lxml-stubs` package instead of custom LXML stubs

* Removed Python 2 comptibility code.

* Fixed bug with unused custom error callback.
* Added support for building with `XMLSEC_NO_XSLT` macro.
* Reactivated documentation builds on RTD.
* Switched docs theme to `furo`.

* Turned off building Python 2.7 wheels in CI pipelines

* Fixed `libxmlsec1` version checks