dtls13: preserve overlapping KeyUpdate flights

[zRedShift]

Draft stacked on #122, which is itself stacked on #121. Once #121 and #122 land, this PR should be rebased onto main and its diff should collapse to the single DIMP-016 commit.

What

This preserves overlapping DTLS 1.3 KeyUpdate flights instead of allowing one side of the overlap to erase the other side's pending update state. It also covers retransmission behavior so a duplicate KeyUpdate still gets a decryptable fresh ACK.

Why

When peers overlap KeyUpdate requests, dimpl can otherwise lose track of the local update or resend stale acknowledgement material. That breaks the DTLS 1.3 post-KeyUpdate state machine under valid overlapping traffic.

Notes

• Stacked on dtls13: preserve app data after same-datagram KeyUpdate #122 because it builds on the same KeyUpdate tail handling and tests.
• Adds DTLS 1.3 regression coverage for overlapping KeyUpdate request/response flows and duplicate retransmission ACK behavior.
• Adds a CHANGELOG row with guessed PR number dtls13: preserve overlapping KeyUpdate flights #123.

Validation

• git diff --check 90989cf..HEAD
• cargo fmt --check
• cargo test --test dtls13 key_update --features rcgen
• cargo test --all-targets --features rcgen
• cargo clippy --all-targets --features rcgen -- -D warnings