deps(rust): bump gotatun from 0.8.1 to 0.9.0 in /wgbridge-rs

[dependabot]

Bumps gotatun from 0.8.1 to 0.9.0.

Release notes

Sourced from gotatun's releases.

v0.9.0

What's Changed

• Remove panics from send and recv tasks by @​Serock3 in mullvad/gotatun#177
• Separate IPv4 fragment reassembly by protocol by @​Ap4sh in mullvad/gotatun#174
• Reject oversized reassembled IPv4 packets by @​Ap4sh in mullvad/gotatun#180
• Validate IPv4 option checksums and lengths by @​Ap4sh in mullvad/gotatun#179
• Allocate device packet buffers on demand by @​VastBlast in mullvad/gotatun#173
• Send persistent keepalive immediately on peer activation by @​VastBlast in mullvad/gotatun#172
• Use dual-stack IPv6/IPv4 sockets by @​hulthe in mullvad/gotatun#178
• Feature gate native socket implementation by @​SocraticSauropod in mullvad/gotatun#125
• Reject invalid base64 keys by @​Ap4sh in mullvad/gotatun#181

New Contributors

• @​VastBlast made their first contribution in mullvad/gotatun#173

Full Changelog: mullvad/gotatun@v0.8.1...v0.9.0

Changelog

Sourced from gotatun's changelog.

[0.9.0] - 2026-08-18

Added

• Add PacketBufPool::new_lazy, which creates a packet pool without initializing any buffers. New packet buffers will be allocated lazily as required when PacketBufPool::get is called.

Changed

• Hide native UDP socket impls behind new socket feature.
• Merge UdpTransportFactory::SendV4 and SendV6 into UdpTransportFactory::Send
• Merge UdpTransportFactory::RecvV4 and RecvV6 into UdpTransportFactory::Recv
• Merge UdpChannelV6Rx and UdpChannelV4Rx into UdpChannelRx..
• Bind only a single dual-stack socket in UdpSocketFactory, instead of a pair of sockets.

Fixed

• Reject malformed base64 keys instead of accepting them as all-zero keys.
• Validate IPv4 checksums and total lengths against the full IHL-declared header.
• Keep IPv4 fragments for different protocols in separate reassembly buffers.
• Reject fragmented IPv4 packets that exceed the maximum packet length after reassembly.
• Send persistent keepalive immediately on peer activation, instead of waiting for one full interval. This matches wireguard-go and Linux kernel wireguard.

Commits

• 284623b Release 0.9.0
• 066556f Merge branch 'reject-invalid-base64-keys'
• e1881df Reject invalid base64 keys
• 10d8453 Merge branch 'dual-stack-ipv6-sockets'
• fe120e5 Update CHANGELOG.md
• bec4096 Simplify Udp traits by merging V4 and V6
• 3512b7e Bump to 0.9.0
• 40aced5 Use dual-stack IPv6/IPv4 sockets
• 5bf90fe Merge remote-tracking branch 'ap4sh/fix-ipv4-options-validation'
• 087ff88 Merge branch 'reject-oversized-ipv4-reassembly'
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)