Address CVE-2025-48924 in Apache Commons Lang3 dep (#16)

[Fix #13] Bump Apache Commons Compress to address CVEs (#14)

- Bump Apache Commons Compress to address CVEs
- Bump `org.tukaani/xz` dep to match version referenced by bumped
  version of Apache Commons Compress.

Closes #13

[Fix #12] Introduce feature flags to make extension of io/Coercions o…

…ptional

These allow dependent libraries to use `fs` without the side-effect of extend.

Otherwise one can unawarely create issues, as seen in https://github.com/clojure-emacs/clj-refactor.el/issues/508.

https://clojure.org/reference/protocols#_guidelines_for_extension says:

> If you don’t own the protocol or the target type, you should only extend in app (not public lib) code, and expect to maybe be broken by either owner.

[Fix #9] Update commons-compress (#10)

Need correct project.clj as well

Update versions

Release 1.5.2

Release 1.5.1

Release 1.5.0

version 1.4.6