fix: bump h2 for RUSTSEC-2026-0258 (#6222)