Unbounded mempool memory leak via timeout path

In `Downloads::poll_next()` the success and error arms remove the `cancel_handles` entry (each holding up to ~2 MB) but the 73-second timeout arm returns without cleanup because `tokio` `Elapsed` carries no `UnminedTxId`, so ordinary unauthenticated P2P traffic leaks memory without bound (~685 KB/s per connection) until the node is OOM-killed. Tracked as CVE-2026-52734 / GHSA-65jj-fmw8-468q; fixed in zebrad 4.5.0.