Release 0.3.2

[mohn93]

Version bump and changelog for the six fixes merged since 0.3.1.

pubspec.yaml and CHANGELOG.md are updated here rather than left to the release
workflow: it only inserts a - Release version 0.3.2 stub when the heading is missing,
which is not worth shipping to pub.dev as the record of a security fix.

What 0.3.2 contains

Security — debug logging no longer writes the FCM token or subscriber PII (#9). With
enableLogging: true, device registration logged the full FCM token, subscriber login
logged name, email, phone and metadata, and tag operations logged tag values. Bodies are
now redacted, with the token keeping a first/last-ten mask so it stays correlatable with
the server. Identifiers are left readable.

Fixed

• registerDevice is single-flight, so two concurrent callers can no longer create
  duplicate device rows with one orphaned server-side (registerDevice has no concurrency guard, so two concurrent callers can create duplicate device rows #10).
• Overlapping permission checks are coalesced across the resume path, the token-refresh
  handler and syncNotificationPermission (registerDevice has no concurrency guard, so two concurrent callers can create duplicate device rows #10).
• reset() clears the subscriber blob and device record unconditionally, so neither a
  null-id blob nor a failed logout leaves state behind (reset() can leave a stored subscriber blob behind #11).
• Plus the three already merged in Fix redundant device PATCH, preference/server divergence, and non-UTC scheduled workflows #8: the redundant PATCH on every launch (registerDevice PATCHes on every launch when the notification preference is off #5), the
  preference saved before the PATCH (setNotificationEnabled saves the preference before the PATCH, so a failed request leaves local and server disagreeing #6), and scheduled workflows firing at the wrong time
  for non-UTC users (Scheduled workflows fire at the wrong time for non-UTC users: scheduledFor is sent without a timezone #7).

Version choice

Patch, not minor: every change is a fix, and no public API on PushFireSDK was added,
removed or changed shape. SubscriberService.clearSubscriberData and
PushFireSDKImpl.clearAllLocalState are both under lib/src/ and not exported.

After merging

Tagging v0.3.2 triggers .github/workflows/release.yml, which runs the suite, creates a
GitHub release, and publishes to pub.dev over OIDC. That publish cannot be undone.

Verified locally: 419 tests pass, and dart pub publish --dry-run is clean.