chore(deps): chant 0.124.25, sslmode=require no longer needs uselibpqcompat (#275)

[lex00]

Closes #275

chant 0.124.25 ships chant#3973, so sslmode=require in a Postgres url now encrypts without verifying the certificate, as in libpq.

• The chant packages are bumped to 0.124.25 in package.json, the lockfile, the templates, the examples and the docs install line. docs/workspace.md still says the workspace needs 0.124.23 or later, because that is still true.
• The Postgres TLS section of docs/configuration.md drops uselibpqcompat=true. It keeps verify-full with sslrootcert for production, and says why older chant needed the extra flag.
• The RDS example url is ?sslmode=require again.

npm ci && npm run build && npm run check passes locally (844 tests).