Merge tag 'v1.13.14' into extended

Integrate upstream sing-box v1.13.14 (18 commits, v1.13.12..v1.13.14).

Conflict resolutions:
- Makefile: keep fork's upload_android (no otherLegacy, codeberg-release.sh),
  add upstream's SFA-version-metadata.json step.
- go.sum: regenerated via go mod tidy from merged go.mod.
- transport/wireguard/endpoint_options.go: keep fork fields, add ICMPTimeout.
- clients/android, clients/apple: keep fork's submodule pointers.

protocol/wireguard/endpoint.go

@@ -100,12 +100,13 @@ func NewEndpoint(ctx context.Context, router adapter.Router, logger log.ContextL
 		}
 	}
 	wgEndpoint, err := wireguard.NewEndpoint(wireguard.EndpointOptions{
-		Context:    ctx,
-		Logger:     logger,
-		System:     options.System,
-		Handler:    ep,
-		UDPTimeout: udpTimeout,
-		Dialer:     outboundDialer,
+		Context:     ctx,
+		Logger:      logger,
+		System:      options.System,
+		Handler:     ep,
+		UDPTimeout:  udpTimeout,
+		ICMPTimeout: C.ICMPTimeout,
+		Dialer:      outboundDialer,
 		CreateDialer: func(interfaceName string) N.Dialer {
 			return common.Must1(dialer.NewDefault(ctx, option.DialerOptions{
 				BindInterface: interfaceName,