release: bump 1.0.2 -> 1.0.3

[kingchenc]

Cuts 1.0.3 for the npm packaging fix in #413.

wickra@1.0.2 shipped every platform binary twice — 98.64 MB unpacked across 22 files, exactly twice the 49.18 MB the six platform packages occupy on npm together. The published package drops to the four files a consumer actually needs.

Bump

Run with bump_version.py, which reported seven WARNs. All seven are false negatives of its name scoper: it requires the package name on the same line as the version, so it cannot see a Maven dependency block or the napi loader. Each was checked and patched by hand.

File	Occurrences	What
SECURITY.md	3	supported-versions prose + table
bindings/java/benchmarks/pom.xml	1	org.wickra:wickra dependency
examples/java/pom.xml	1	org.wickra:wickra dependency
bindings/node/index.js	52	napi version-check literal

git grep 1.0.2 outside CHANGELOG.md and the lockfiles is empty afterwards.

Checked against the #412 regression

The 1.0.1 -> 1.0.2 bump corrupted third-party versions in the npm lockfiles and took down every Node job. Verified that it did not recur:

• both package-lock.json files changed only wickra-* entries; every third-party version is untouched
• npm ci succeeds in bindings/node and in examples/node
• Cargo.lock moved nine entries, all workspace crates

Local verification

cargo fmt --all, cargo test --workspace --all-features and cargo clippy --workspace --all-targets --all-features -- -D warnings all pass.

The docs and webpage version strings are deliberately untouched — sync-about.yml rewrites those on the v* tag.