cargo: use reqwest 0.9.5 plus a fix for multi-valued headers

reqwest 0.9 changed behavior from 0.8 and no longer supports multiple values for the same header. Use a custom tag until this is fixed upstream.