chore: bump APISIX-Runtime to 1.4.0

[shreemaan-abhishek]

Description

Bumps APISIX_RUNTIME from 1.3.19 to 1.4.0, with the version guard and the two apisix-runtime-debug checksums in ci/linux-install-openresty.sh.

What moves in apisix-runtime 1.4.0:

Component	1.3.19	1.4.0
OpenResty (nginx)	1.29.2.4 (1.29.2)	1.31.1.1 (1.31.1)
OpenSSL	3.4.1	3.5.9
apisix-nginx-module	1.19.11	1.20.0 (api7/apisix-nginx-module#128)
ngx_multi_upstream_module	1.3.4	1.4.0 (api7/ngx_multi_upstream_module#23)

• Security: OpenSSL 3.5.9 and nginx 1.31.1 carry the security fixes released since OpenSSL 3.4.1 and nginx 1.29.2.
• Upstream keepalive: nginx 1.29.7 made upstream keepalive implicit and changed where it wraps the balancers. apisix-nginx-module 1.20.0 restores the old order, so apisix_backend (keepalive declared before balancer_by_lua) and apisix_dubbo_backend (declared after) keep the 1.3.19 behavior.
• TLS key exchange: OpenSSL 3.5 adds the post-quantum hybrid group X25519MLKEM768 to its default key shares, so TLS 1.3 handshakes offer it on both client and server sides.

t/core/runtime-version.t asserts the runtime is at least nginx 1.31.1 and OpenSSL 3.5.9.

Two fixes the new runtime needs:

• prometheus process metrics (feat(prometheus): export per-process timers, connection slots and Lua memory #14034): process_metrics.lua mirrors the head of ngx_cycle_t through FFI. nginx 1.29.7 appends NGX_COMPAT_BEGIN(5) to ngx_log_t, so in --with-compat builds such as apisix-runtime every field after new_log moves by 40 bytes. The plugin then read a garbage connections pointer, and its self check dereferenced it before comparing anything, which crashed every worker with SIGSEGV. The cdef now adds the spare slots on nginx 1.29.7+ --with-compat builds, and the self check compares connection_n against worker_connections before it follows the pointer, so a future layout change disables the metric instead of crashing. Verified on runtimes 1.3.19 and 1.4.0: both now read 64 slots (60 free) with the event pointers matching. t/plugin/prometheus-process-metrics.t covers it on 1.4.0.
• t/plugin/ocsp-stapling.t: OpenSSL 3.5 s_client prints the signature scheme name (ecdsa_secp256r1_sha256, rsa_pss_rsae_sha256) in Peer signature type, where 3.4 printed ECDSA / RSA-PSS. TEST 17 and 20 now match either form.

cc @nic-6443 for the prometheus change.

Checksums were taken from the published release artifacts:

09d979543e65d6b16994d754f55ea759fe558fbb824fa8aed2ecd72a139b91b4  apisix-runtime-debug_1.4.0-0.debianbookworm-slim_amd64.deb
d5803bd4c793332f0412968a85407a498de3b85c372edb65fcd0019aaaf05990  apisix-runtime-debug_1.4.0-0.debianbookworm-slim_arm64.deb

Which issue(s) this PR fixes:

N/A

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes or the new features added to this PR
• I have added tests corresponding to this change
• I have updated the documentation to reflect this change
• I have verified that this change is backward compatible (If not, please discuss on the APISIX mailing list first)