Summary

Closes #1296.

BrotliDecoder calls process() / decompress() with output_buffer_limit, which only exists in Brotli >= 1.2.0 and brotlicffi >= 1.2.0.0. The brotli extra declares minimum versions, but packages that depend on plain httpx2 (for example huggingface_hub) can end up with an older Brotli that happens to be installed already. In that case any br response crashes with TypeError: process() takes no keyword arguments.

This PR checks the importable binding's __version__ once at import time and requires brotli>=1.2.1 or brotlicffi>=1.2.1.0. Earlier releases are vulnerable to CVE-2026-111497 (GHSA-9v8h-qqgm-4m35), as noted in #1311. A binding below the minimum is treated like a missing Brotli install: br is removed from SUPPORTED_DECODERS, so it is no longer advertised in Accept-Encoding. If brotli is too old, brotlicffi is tried next.

The brotli extra is raised to the same minimums, and the missing-decoder error now names them.

Checked against an installed Brotli:

• Brotli==1.1.0 before: TypeError: process() takes no keyword arguments
• Brotli==1.2.0 after: br is not supported, and BrotliDecoder() raises Using 'BrotliDecoder', but neither 'brotli>=1.2.1' nor 'brotlicffi>=1.2.1.0' is installed.
• Brotli==1.2.1 after: br decodes normally

Checklist

• I understand that this PR may be closed in case there was no previous discussion. (This doesn't apply to typos!)
• I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
• I've updated the documentation accordingly.