docs(changelog): add CHANGELOG.md to close OpenSSF release_notes (RAN… #19

Job	Run time
OSV-Scanner (SCA)	7s
SBOM (SPDX + CycloneDX)	9s
jscpd (duplication < 3% on touched code)	10s
Trivy (filesystem + container scan)	14s
Semgrep (SAST)	24s
Gitleaks (secret scan)	7s
	1m 11s

Provide feedback