Artifact rebuilds (e.g. dependency bundling) change the file behind
<pkg>-<ver>.tar.zst while keeping its name, so users with the previous
file in their AUR helper cache hit a checksum mismatch. Naming the local
download <pkg>-<ver>-<rel>.tar.zst makes every rebuild a fresh file.
Upstream 4.0 replaced python-webuntis with pyotp for authentication and
unconditionally imports libsecret (credential storage) and WebKitGTK 6.0
at startup. Add python-pyotp, libsecret and webkitgtk-6.0 to depends.
Stop bundling the webuntis wheel from the next artifact build on; the
existing 4.0 artifact is reused as-is (its bundled copy is unused and
inert).