Bump `bdk_esplora` once it picks up `esplora-client` 0.13.0

Tracking issue, promised in https://github.com/bitcoindevkit/bdk-cli/pull/281. Nothing to fix here yet - the fix has to land upstream first.

`cargo audit` on `master` is still red: three advisories against `rustls-webpki 0.101.7`, pulled in transitively through `minreq 2.14.1`.

The `0.103.x` occurrence is already gone from the lockfile, fixed by #242; #281 proposed the same bump and was closed as superseded once rebasing left an empty diff. The `0.101.7` one was never addressed, hence this issue.

---
```console
$ cargo audit
Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
Loaded 1173 security advisories (from /home/v/.cargo/advisory-db)
Updating crates.io index
Scanning Cargo.lock for vulnerabilities (431 crate dependencies)
Crate: rustls-webpki
Version: 0.101.7
Title: Reachable panic in certificate revocation list parsing
Date: 2026-04-22
ID: RUSTSEC-2026-0104
URL: https://rustsec.org/advisories/RUSTSEC-2026-0104
Solution: Upgrade to >=0.103.13, <0.104.0-alpha.1 OR >=0.104.0-alpha.7

Crate: rustls-webpki
Version: 0.101.7
Title: Name constraints for URI names were incorrectly accepted
Date: 2026-04-14
ID: RUSTSEC-2026-0098
URL: https://rustsec.org/advisories/RUSTSEC-2026-0098
Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6

Crate: rustls-webpki
Version: 0.101.7
Title: Name constraints were accepted for certificates asserting a wildcard name
Date: 2026-04-14
ID: RUSTSEC-2026-0099
URL: https://rustsec.org/advisories/RUSTSEC-2026-0099
Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6

error: 3 vulnerabilities found!
```

```console
$ cargo tree --all-features -i rustls-webpki@0.101.7
rustls-webpki v0.101.7
├── minreq v2.14.1
│ ├── esplora-client v0.12.3
│ │ └── bdk_esplora v0.22.2
│ │ └── bdk-cli v4.0.0 (/home/v/src/bitcoindevkit/bdk-cli)
│ └── jsonrpc v0.18.0
│ └── bitcoincore-rpc v0.19.0
│ ├── bdk_bitcoind_rpc v0.22.0
│ │ └── bdk-cli v4.0.0 (/home/v/src/bitcoindevkit/bdk-cli)
│ └── bitcoind v0.36.1
│ └── electrsd v0.28.0
│ └── bdk_testenv v0.13.1
│ [dev-dependencies]
│ └── bdk-cli v4.0.0 (/home/v/src/bitcoindevkit/bdk-cli)
├── minreq v2.14.1
│ [build-dependencies]
│ ├── bitcoind v0.36.1 (*)
│ └── electrsd v0.28.0 (*)
└── rustls v0.21.12
├── minreq v2.14.1 (*)
└── minreq v2.14.1 (*)
```

Three independent paths lead to `minreq`, and this issue tracks only the first:

1. `esplora-client` -> `bdk_esplora`.
2. `jsonrpc` -> `bitcoincore-rpc` -> `bdk_bitcoind_rpc` - waiting on the `corepc-client` migration upstream, `rust-bitcoincore-rpc` being archived.
3. `bitcoind` / `electrsd` -> `bdk_testenv`, as dev- and build-dependency - independent of both.

So the bump will not turn `cargo audit` green on its own: it clears one path of three, and the same three advisories keep being reported through the other two. Each needs its own upstream fix.

### Upstream status

- `esplora-client` dropped `minreq` in favour of `bitreq` in v0.13.0 - bitcoindevkit/rust-esplora-client#137.
- `bdk_esplora` has not picked that up yet. Latest release is `0.22.2`, still on `esplora-client 0.12.x`.
- The bump lives in bitcoindevkit/bdk#2189, still open. It is deliberately held back: `bitreq` does not properly support a WASM transport yet, and the plan discussed there is to wait for a `0.13.x` point release that fixes it.

Start by checking the upstream bdk#2189 status and the planned esplora-client 0.13.x release, then inspect Cargo.lock and run cargo tree --all-features -i rustls-webpki@0.101.7. Done means updating bdk_esplora after the WASM-compatible upstream fix lands and confirming this dependency path is removed; the other two paths remain separate.

Written by the indexing model from the issue text.