Internet Archive CLI

**Security** - The published `ia` pex binary for 5.12.0 bundled certifi 2026.7.22, which still trusts the emSign root CAs whose intermediate keys were compromised (GHSA-6q48-6c7w-9gw2). This release rebuilds the binary with certifi 2026.10.19. `certifi>=2026.10.19` is now also a declared dependency, so `pip install -U internetarchive` carries the fix into existing environments. - Development and CI dependencies updated past their open advisories: urllib3 2.8.0 (CVE-2026-97687, CVE-2026-97688, CVE-2026-97689) and virtualenv 21.14.12 (sixteen activation-script and seed-wheel advisories). - `ia --insecure` now prints a warning to stderr on every invocation that the request, including S3 keys and cookies, goes over unencrypted HTTP, and its `--help` text says the same. A `SECURITY.md` documents how to report vulnerabilities privately. - The `ia` pex binary is now built from the versions pinned in `uv.lock`, with every bundled wheel verified against the lockfile's sha256, instead of from a hand-maintained list of version floors that took whatever PyPI served on build day. The build fails if any dependency lacks a universal wheel, so the binary stays platform-