Coturn 4.16.0

• Restore support for hiredis < 1.1.0 (for AlmaLinux/RHEL/Rocky Linux 9)
• Add --stateless-nonce: bound memory under valid-structure STUN floods
• docs: cite RFC 7350 for DTLS support in README
• DTLS listener: correct the handshake buffer bound and remove the non-functional client-cert path
• Fix NULL deref: --prometheus-address/-path/-port take a required value
• Return 508, not 400/440, when a well-formed Allocate cannot be satisfied
• Narrow ChannelBind to the RFC 8656 channel range 0x4000-0x4FFF
• Split --stun-backward-compatibility: move RFC 3489 handling to its own deprecated flag
• docs: record the RFC 3489 deprecation roadmap; fix stale option text
• DTLS: drop non-handshake records from unknown sources
• DTLS: cap concurrent half-open handshakes (pre-cookie state-exhaustion)
• docs: state OpenSSL 3.0+ as the supported target; drop stale guidance
• DTLS: release idle handshake buffers on half-open sockets
• docs: state the comment style expected in CLAUDE.md
• Declare ERROR-CODE / ADDRESS-ERROR-CODE reason phrases without padding
• Send: make a duplicate XOR-PEER-ADDRESS first-wins instead of last-wins
• multiplex-peer: bound the shared per-thread peer demux table
• tests: broaden TURN server core coverage to Send and CreatePermission