Release github.com/tempoxyz/mpp-go@0.4.0

[github-actions]

This PR was opened by the Changelogs release workflow.

When you're ready to release, merge this PR and the packages will be published.

---

github.com/tempoxyz/mpp-go@0.4.0

Minor Changes

• Add split credential validation and broadcast lifecycle hooks, with Tempo API relay configuration for server-side charges. (by @brendanryan, #110)

Patch Changes

• Fix the client challenge filter so a challenge whose expires cannot be parsed is skipped instead of treated as valid, preventing the client from paying a challenge the server is guaranteed to reject. (by @WinterRong, #88)
• Update Go dependencies in the weekly Dependabot batch. (by @dependabot[bot], #109)
• Batch routine dependency updates weekly and automatically merge patch and minor
• updates after all pull request checks pass. (by @brendanryan, #104)
• Return a fresh WWW-Authenticate: Payment challenge when payment credential verification fails, allowing clients to retry with the current challenge. (by @pranjalpaliwal, #74)
• Decode a bare 0x (and empty) hex quantity as zero in ParseHexUint64, matching ParseHexBigInt so both JSON-RPC integer decoders agree on zero-value forms returned by lenient nodes. (by @salad, #91)
• Accept legacy challenge descriptions containing unescaped quotes. (by @brendanryan, #105)
• Reject a negative decimals in ParseUnits (and thus TransformUnits) instead of panicking on the fractional-part slice. (by @alex, #87)
• Reject malformed WWW-Authenticate: Payment auth-param lists instead of silently accepting trailing bare parameters or missing separators. (by @markharrison, #92)
• Strip CR and LF characters in the default FormatAuthenticate path so a Challenge field containing \r\n (e.g. Description, Realm) can no longer split the WWW-Authenticate header and inject a response. FormatAuthenticateStrict continues to reject such values with an error. (by @TLeao, #86)
• Refuse standalone Transport auto-pay after a redirect. A Transport used with a bare http.Client (no CheckRedirect) had none of Client.Do's cross-origin redirect protection, so a redirect to an attacker origin could be auto-paid. The Transport now fails closed on any redirect-produced request when no trusted origin is pinned in the context. (by @mattew, #84)
• Reject non-hexadecimal 32-byte memos in EncodeTransferWithMemo instead of producing invalid Tempo calldata. (by @markharrison, #100)