chore(deps): bump multistore to 0.7.0

[alukach]

Bumps the multistore crate family to 0.7.0, pulling in developmentseed/multistore#115 and the rest of the 0.7.0 release.

What's in 0.7.0

• sts: accept AssumeRoleWithWebIdentity params from form-encoded POST bodies (#112)
• enforce conditional-write preconditions on PutObject (feat: real-time location WebSocket via Durable Objects #122)
• same-store CopyObject via x-amz-copy-source (#121)
• upgrade object_store → 0.14, reqwest → 0.13, unpin worker (fix: handle Range header in HEAD requests #114)

Knock-on changes required by the dep upgrades

The object_store/reqwest/worker bumps in 0.7.0 forced a few local adjustments:

• worker / worker-macros =0.7.4 → =0.7.5 — multistore-cf-workers 0.7.0 requires worker ^0.7.5
• our own reqwest 0.12 → 0.13 so HTTP_CLIENT's Client type matches the one multistore-sts::jwks::new now expects (keeps a single reqwest in the tree)
• enable reqwest's new form feature — .form() became opt-in in 0.13 (was always-on in 0.12) and is needed for the STS post_form call in FetchHttpExchange

Verification

• cargo check --target wasm32-unknown-unknown ✓
• cargo clippy --target wasm32-unknown-unknown -- -D warnings ✓
• cargo test — all suites pass ✓

🤖 Generated with Claude Code

[claude]

Claude finished @alukach's task in 1m 6s —— View job

---

Reviewing PR #190: bump multistore to 0.7.0

• Gather context (PR diff, files changed)
• Review Cargo.toml changes
• Review Cargo.lock changes
• Check for security/correctness issues in dependency bump
• Post final review

---

✅ No blocking issues — safe to merge.

• Cargo.toml:39-42,70 — multistore crate family bumped 0.6.4 → 0.7.0 consistently across all four crates (multistore, multistore-oidc-provider, multistore-path-mapping, multistore-sts, multistore-cf-workers); Cargo.lock confirms matching checksums for all five, no version skew.
• Cargo.toml:75 — reqwest bumped 0.12 → 0.13 with default-features = false, features = ["form"]. Verified via Cargo.lock that only a single reqwest version resolves in the tree (no duplicate reqwest instances), matching the PR description's stated goal of keeping one reqwest so HTTP_CLIENT's Client type matches what multistore-sts::jwks::new expects.
• Cargo.toml:87-88 — worker/worker-macros pinned =0.7.4 → =0.7.5, satisfying multistore-cf-workers 0.7.0's worker ^0.7.5 requirement.
• Cargo.lock diff is consistent with the Cargo.toml bumps — transitive changes (e.g. webpki-roots → rustls-platform-verifier/webpki-root-certs, new aws-lc-rs/aws-lc-sys) are expected fallout of the reqwest 0.12 → 0.13 upgrade (its new default TLS cert-verification stack), not anything introduced by this PR directly. Since the wasm32 target build uses default-features = false here, these TLS-stack deps only apply to non-wasm (test) builds.
• No stray/unrelated dependency changes, no version downgrades, no obviously vulnerable transitive deps introduced.
• PR description states cargo check --target wasm32-unknown-unknown, cargo clippy -- -D warnings, and cargo test all pass, consistent with what the diff would require.

[github-actions]

🚀 Latest commit deployed to https://source-data-proxy-pr-190.source-coop.workers.dev

• Date: 2026-07-22T23:12:35Z
• Commit: 1b07f42