rando youtubers are onshotting minecraft clones with a one sentence prompt

This is brutal for a library this old. I thought I was good at this 🤣 - SOUNDNESS: Oid is now Oid<'a>, tracking the lifetime of its BER bytes. OIDs borrowed from an OidSet can no longer be copied out and used after the set is freed. Pre-defined constants and gssapi-returned mechanism OIDs are Oid<'static>. Add `assume_static` and `from_raw_desc` (both unsafe) for the rare cases that need them. - SOUNDNESS: removed the safe `From<gss_cred_id_t> for Cred` and `From<gss_OID_desc> for Oid` conversions. Use `Cred::from_c` / `Oid::from_raw_desc` (both unsafe) instead — wrapping a raw handle is not a safe operation. - SOUNDNESS: dropped `Sync` from ClientCtx/ServerCtx. GSSAPI forbids concurrent use of a single security context; share via Mutex if needed. `Send` is retained. - SOUNDNESS: removed `DerefMut` for GssIov (stream unwrap_iov can alias buffers); use the new `unsafe fn as_mut_slice` when you need mutation. - SOUNDNESS: fixed a dangling pointer where an Oid passed by value to a mechanism argument could be dropped before the FFI call read it. - BUGFIX: Cred::store wrote its outputs into stack temporaries, so it always returned an empty OidSet and CredUsage::Both. It now returns what gssapi actually stored. - BUGFIX: GSS_NT_ANONYMOUS had a wrong BER encoding (an invalid `\01` escape produced 7 bytes instead of 6). It is now 2b 06 01 05 06 03. - BUGFIX: ServerCtx/ClientCtx flag handling no longer discards all flags when gssapi returns an unrecognized flag bit. - BUGFIX: the wrapper no longer fails to build against Heimdal. It named MIT-specific struct tags (gss_name_struct, gss_cred_id_struct) to spell null handles; it now uses the portable handle typedefs, which both MIT and Heimdal provide. The s4u feature remains MIT-only (Heimdal has no gss_acquire_cred_impersonate_name / gss_store_cred_into). - API: OidSet no longer implements Index; use `OidSet::get(i) -> Option`. `OidSet::new` is now infallible (returns OidSet, not Result), wrapping GSS_C_NO_OID_SET until the first `add`. - API: SecurityContext inquiry methods (info, source_name, lifetime, mechanism, flags, local, open, etc.) now take &self instead of &mut self. - API: methods that took `&Oid` now take `Oid` by value (it is Copy). - BUILD: new LIBGSSAPI_IMPL env var (mit|heimdal|apple) forces the implementation, overriding autodetection. Useful when both MIT and Heimdal are installed and the probe order would otherwise pick MIT. - BUILD: new LIBGSSAPI_PREFIX env var (colon-separated install prefixes) adds <prefix>/include to bindgen and <prefix>/lib to the linker, and is searched during autodetection. Replaces the old recursive `find` over the system lib dirs, which has been removed in favor of a cheap non-recursive check. - Switched to edition 2024 with #![deny(unsafe_op_in_unsafe_fn)]. - Added a local integration test suite (tests/test.sh) that runs against both MIT and Heimdal, plus pure-Rust tests under Miri.

Specific example that came up recently. Had Claude port an old complex gtk3 rust app to iced. Had "working" code in about half an hour, probably 100x faster than I would have done it. Most features worked, felt like "am I releasing this today". LOL, no This app has a big complex spreadsheet like table widget that subscribes to network data, LOTS of network data. Found that Claude decided it was a good idea to create a new mpsc channel, and spawn a new tokio task FOR EVERY CELL in the table, and then throw all that at a single mutex to update the view. Both Opus 4.7 and Codex 5.5 reviewed this code multiple times and saw no issues doing this. If it had gone into production it would have exploded the first time someone looked at a table with 1 million rows and 100 columns 😂 That was just the beginning, the api of gtk3 is very different from the api of iced, and that created a lot of opportunity to increase the compile time safety, clarify the code, and generally prevent problems. Neither Claude nor GPT were able to spot most of these opportunities, or if they did, they didn't feel like I told them to make big changes like that, so were conservative in their changes.