gRPC for Ruby 1.83

Apply the Ruby 4.0 baseline first. These rules cover the gRPC Ruby 1.83 gem and its native Core transport on Ruby 4.0, including generated protobuf services and all four RPC shapes; they were checked against 1.83.1.

Dependencies and native Core

• gRPC supports only its current release and the one before it, with no LTS, and backports a security fix further only when its severity warrants. Plan migration to a release with the Ruby metadata and proxy-hostname fixes that 1.83.0 and 1.83.1 lack, and keep the interim restrictions below until you run one.
• gRPC publishes some fixes only in release notes or in repository advisories without a CVE, and bundle-audit and OSV-Scanner don't report those for the grpc gem. Check the grpc/grpc security advisories and release notes on a schedule, and take a release they list as fixing yours.
• Keep the message_size_refactoring, ph2_perf_01, and header_data_frame experiments enabled, as they are by default, because they carry the native Core protections against unbounded decompression, oversized GOAWAY allocations, and memory build-up from floods of tiny HTTP/2 DATA frames; do not disable them through negative entries in GRPC_EXPERIMENTS.
• Resolve google-protobuf within >= 3.25, < 5.0 and googleapis-common-protos-types within ~> 1.0. Pin compatible grpc-tools and protobuf compiler versions; never pair newly generated code with a protobuf runtime older than its generator.
• Generate _pb.rb and _services_pb.rb only from reviewed schemas. Keep GRPC::GenericService message classes and marshal/unmarshal methods