deps: bump webdriver-downloader to 0.17.0

[jqnatividad]

Summary

Bumps the plotly_static build dependency webdriver-downloader from 0.16 to 0.17.0.

webdriver-downloader 0.17.0 clears RUSTSEC-2025-0134 (the unmaintained rustls-pemfile crate) and updates its dependency tree to current majors: reqwest 0.13, fantoccini 0.22, thiserror 2, nix 0.31, which 8, zip 8.

Closes #427.

Note

Stacked on #425 — merge that first. Until #425 lands, this PR's diff carries #425's commits; once it merges, this shrinks to just the dependency bump (plotly_static/Cargo.toml + CHANGELOG.md).

Why no build.rs changes are needed

plotly_static/build.rs uses only the stable/additive subset of the API — ChromedriverInfo::new / GeckodriverInfo::new, the WebdriverDownloadInfo trait methods, WebdriverDownloadError, and the os_specific::* browser-path helpers — all still present in 0.17.0.

The 0.17.0 "breaking" change only widens the public error enums to expose dependency types (zip::result::ZipError, reqwest::Error, which::Error). build.rs never matches on those variants — it propagates errors with ?, {:?}, and .context(e) — so the change is invisible to it. Default feature remains native-tls, unchanged from 0.16.

Verification

Both driver paths are behind mutually-exclusive #[cfg] features, so each was built explicitly (a bare build compiles none of the webdriver-downloader call sites):

cargo build -p plotly_static --features chromedriver   # ok, webdriver-downloader v0.17.0
cargo build -p plotly_static --features geckodriver     # ok
cargo clippy -p plotly_static --features chromedriver -- -D warnings   # clean
cargo tree -p plotly_static -i rustls-pemfile           # no match — advisory crate gone

🤖 Generated with Claude Code