Replace unmaintained bincode with postcard for asset serialization

[Xavrir]

Summary

Replace the unmaintained bincode crate with postcard for asset serialization, addressing RUSTSEC-2025-0141.

Changes

• Cargo.toml: bincode = "1.0" → postcard = { version = "1.0", features = ["alloc"] }
• src/assets.rs: Deserialization via postcard::from_bytes() instead of bincode::deserialize_from()
• src/assets/build_assets.rs: Serialization via postcard::to_allocvec() instead of bincode::serialize_into()
• assets/*.bin: Rebuilt with postcard format via assets/create.sh
• CHANGELOG.md: Added entry under "Other"

Why postcard?

• Actively maintained and recommended by RustSec as a replacement
• Serde-compatible — minimal code changes required
• Designed for embedded/resource-constrained environments (compact output)
• Widely used in production Rust projects

Notes

• Cache compatibility: Users with existing bat cache --build caches from the old bincode format will need to rebuild (bat cache --build). The existing metadata.yaml version check will reject incompatible caches when the minor version bumps.
• Binary assets: All three .bin files (syntaxes, themes, acknowledgements) have been rebuilt using the new serialization format.
• All 377 tests pass.
• Related: replace unmaintained bincode with postcard #3595 (similar approach, currently in draft)

Closes #3582