Prepare 4.0.0 release

[aalekz]

Updates the plugin to Castle Android SDK 4.0.2 and Castle iOS SDK 4.2.0.

Replaces #63. The version goes straight from 2.2.1 to 4.0.0 so that the plugin major matches the major version of the native SDKs it wraps — there is no 3.x release.

Breaking changes

• iOS is now Swift Package Manager only. Castle iOS 4.x is not published to CocoaPods (trunk stops at Castle 3.2.0), so castle_flutter.podspec is removed. Note that flutter pub get fails for every platform while SPM is disabled, so consumers on Flutter < 3.44 must run flutter config --enable-swift-package-manager.
• Minimum Android API level is now 26 (Android 8.0), up from 21 — required by castle-android 4.x.
• Minimum iOS 13.0, minimum Flutter 3.29.0, minimum Dart SDK 3.4.0.
• Removed flushIfNeeded(url), userAgent and queueSize — these no longer exist in the native SDKs. The removal list was derived from the shipped binaries (CastleSDK.swiftinterface and javap over the 4.0.2 AAR), not from the docs.

Fixes and enhancements

• advertisingIdentifier(id) now works on Android via the new adIdProvider option; it was previously a no-op there.
• Fixed baseURLAllowList never being applied on iOS — Dart sends strings but the plugin cast them to Array<URL>, so the cast always failed silently.
• Fixed the Swift package failing to resolve at all: it declared a dependency on a local FlutterFramework package that the Flutter tool never generates. Flutter is provided by the Xcode project, so plugins must not declare it.
• CI moves off the unmaintained cirrusci/flutter image (stuck on Dart 2.19.4, which cannot satisfy the new SDK floor) to ghcr.io/cirruslabs/flutter:stable, and SPM is enabled before flutter pub get.

Verification

• flutter analyze clean, flutter test passing
• Example app built and run on both platforms: iOS simulator via SPM (CastleSDK.framework embedded, resolved 4.2.0) and an Android API 35 emulator (libcas.so loaded). Both produce a real request token and X-Castle-Request-Token.
• Every event method exercised on Android with no exceptions; the test job was run inside the new CI image.