docs: sync CHANGELOG + mark older plans superseded after PR #91 #148

Job	Run time
Gitleaks (secret scan)	7s
OSV-Scanner (SCA)	5s
SBOM (SPDX + CycloneDX)	19s
Semgrep (SAST)	18s
jscpd (duplication < 3% on touched code)	16s
Trivy (filesystem + container scan)	9s
	1m 14s

Provide feedback