Update h2 to >=0.4.16 for actix-http

Your issue may already be reported! Please search on the [Actix Web issue tracker](https://github.com/actix/actix-web/issues) before creating one.

## Expected Behavior

Hi! 👋

I'm using actix-http in a test setup for one of my projects (cc @wiktor-k).
Due to our CI we noticed, that the h2 version currently in use in actix-http seems to be vulnerable to https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h

I unfortunately know nothing about your code base, so I have no idea how hard it is for you to port to a new version of h2.
As such, this ticket is of course more of a heads up! :)

Thanks for providing this project! 🚀

## Current Behavior

h2 0.3 is used.
h2 0.4 could/should probably be used.

## Possible Solution

Upgrade/port to h2 >=0.4.16

## Steps to Reproduce (for bugs)

1. run e.g. `cargo-deny` on a project using actix-http

## Context

Personally, this issue is not affecting me at all, as our project does not use the http2 feature.
However, the lock file still contains the h2 0.3 dependency.
Other projects, using the http2 feature of actix-http may be affected.

## Your Environment

- Rust Version (I.e, output of `rustc -V`): rustc 1.97.1 (8bab26f4f 2026-07-14)
- Actix Web Version: actix-web 4.14.0; actix-http 3.13.0