chore(deps): bump hyperlane and hyperlane-core to 21.12.0

[vshengbro]

Summary

Bump hyperlane and hyperlane-core requirements to 21.12.0 (from 21.7.8). The two entries also move within the [workspace.dependencies] block to keep the §13.7 round-4 length-then-lexicographic order valid — the longer version strings changed their sort keys (verified with fix_dep_order.py --write + verify_dep_order.py, 0 violations).

hyperlane-core 21.12.0 changes Server::route to pub fn route<S>(&mut self, path: impl AsRef<str>) (hyperlane-dev/hyperlane#43). This branch registers all routes through the #[route] attribute macro, which uses inventory::submit! + HookType::Route and never calls Server::route — so no route call sites change here (grep -rn 'route::<' returns 0).

One adaptation is required for a different change shipping in the same release: 21.12.0 reduces several http-constant header-name constants to pub(crate) (hyperlane §18 const-visibility sweep, commit 684f3c0). This branch consumed eight of them across controllers, views, services and middleware, so they now live as one crate-local copy:

• application/header/const.rs (new) — pub(crate) const copies of ACCEPT_RANGES, AUTHORIZATION, CACHE_CONTROL, CONTENT_DISPOSITION, CONTENT_RANGE, DATE, EXPIRES, RANGE
• application/header/mod.rs (new) — mod r#const; + pub(crate) use r#const::*;
• application/lib.rs — wire mod header; + pub(crate) use header::*; so every module reaches them through the existing use super::*; chains

EMPTY_STR was deliberately not copied: it is still pub in http-constant 21.12.0, and a local copy caused E0659 glob ambiguity (verified by build).

Cargo.lock intentionally still pins 21.10.0: crates.io only serves 21.12.0 after hyperlane-dev/hyperlane#43 merges and the publish workflow runs. Refresh with cargo update -p hyperlane afterwards.

Verification

Verified locally with a temporary [patch.crates-io] pointing at the hyperlane 21.12.0 working tree (patch section removed before commit):

• cargo build --workspace — clean (21.12.0 path-patched)
• cargo clippy --workspace --all-targets — 0 code warnings/errors
• cargo test --workspace --all-features — 1 test passes, all other suites empty
• cargo fmt --all + --check — 0 diff, idempotent
• verify_dep_order.py — 0 violations after reorder
• staged_file_gate.py (pre-commit hook) — 0 new violations
• No route::<T, P> patterns exist anywhere in the codebase

Notes

• Blocked on feat(server): infer route path type via impl AsRef<str> parameter hyperlane#43: CI here cannot resolve hyperlane = "21.12.0" until that PR merges and the publish job uploads 21.12.0 to crates.io. Merge this only after the lockfile refresh succeeds.
• Pre-existing CI issue on playground: the sync_workspace_version job's Update Cargo.lock step has been failing since before this change (run 37859018004), so the Rust build jobs never start on this branch. That failure is unrelated to this PR and needs its own fix.
• Master gets the same treatment in chore(deps): bump hyperlane and hyperlane-core to 21.12.0 #22.