Allow hackney 4.x

[janwillemvd]

excontainers only reaches hackney through Tesla.Adapter.Hackney and makes no direct :hackney.* calls, so it can follow Tesla's own supported range instead of pinning ~> 1.16.

That pin was the last thing holding qdentity/mindfields-phx on hackney 1.25.0, which carries four advisories — all first patched in 4.0.1:

Advisory	Severity
GHSA-gp9c-pm5m-5cxr — ssl:connect/2 post-handshake upgrade has no timeout	high
GHSA-j9wq-vxxc-94wf — CR/LF injection in query parameter	moderate
GHSA-pj7v-xfvx-wmjq — SSRF allowlist bypass via percent-encoded host	moderate
GHSA-mp55-p8c9-rfw2 — CRLF / header injection via domain/path	low

The new requirement mirrors Tesla's: hackney 2.x, 3.x, 4.0.0 and 4.0.1 are excluded because they lack exports Tesla relies on.

Follows the same pattern as #1 (relax tesla) and #2 (allow gestalt 2.x).

[greptile-apps]

Required label not found on this PR.

[janwillemvd]

Heads-up: relaxing the constraint is correct in principle, but hackney 4.x cannot actually be used by excontainers yet — 4.7.2 broke unix-domain-socket connections, which is exactly how we reach the Docker daemon.

http+unix:// URLs still parse correctly (transport: hackney_local_tcp, host: ~c"/var/run/docker.sock", port: 0) and hackney_local_tcp.erl is byte-identical to 1.25.0, but the connection attempt in 4.x's rewritten conn layer routes through hackney_happy (happy-eyeballs DNS) instead of dispatching to the local_tcp transport:

hackney	:hackney.request(:get, "http+unix://%2Fvar%2Frun%2Fdocker.sock/v1.41/version", [], "", [])
1.25.0	{:error, :enoent} (tried the socket)
4.7.2	{:error, :nxdomain} (tried DNS)

In qdentity/mindfields-phx this makes Excontainers.Container.init/1 fail and takes out every test using PostgresContainer (qdentity/mindfields-phx#4587 was dequeued by the merge queue over it).

So this widened requirement lets the solver pick a hackney that does not work here. Worth either reverting until upstream restores unix-socket support, or keeping it with a comment that 4.x is currently unusable for the Docker transport.