docs(changelog): add CHANGELOG.md to close OpenSSF `release_notes` (R… #20

Job	Run time
jscpd (duplication < 3% on touched code)	16s
SBOM (SPDX + CycloneDX)	9s
Gitleaks (secret scan)	13s
OSV-Scanner (SCA)	4s
Trivy (filesystem + container scan)	33s
Semgrep (SAST)	36s
	1m 51s

Provide feedback