chore(deps): update metcalfc/changelog-generator action to v5

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
metcalfc/changelog-generator	action	major	v4.9.1 → v5.0.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

metcalfc/changelog-generator (metcalfc/changelog-generator)

v5.0.1

Compare Source

• 031a640 - 5.0.1
• 122a6c2 - Base the changelog on the previous release of the same line, and assert it (#​479)
• 0bee5ad - fix: return the modified changelog as a real multiline output (#​478)

v5.0.0

Compare Source

Breaking change: commit subjects render as literal text

Every changelog line now wraps the commit subject in an inline-code span.

before:  - [f723555](.../commit/f723555) - build(deps-dev): bump @vercel/ncc to 0.45.0 (#​470)
after:   - [f723555](.../commit/f723555) - ` build(deps-dev): bump @vercel/ncc to 0.45.0 (#​470) `

A commit subject is untrusted input. Anyone whose pull request you merge
chooses that text, and this action pastes it directly into your release notes.
Rendered as active Markdown, a subject could contribute links, images,
@mentions, issue references, raw HTML, or additional changelog entries to a
release it had no business editing. Rendering it as literal text closes that
off.

What this costs you. Subjects render monospace, and #123, GH-123, bare
commit SHAs, and :emoji: inside a subject no longer autolink. Because
GitHub's squash merge appends (#​123) to the subject by default, most lines
in a typical repository lose that link. The generated commit link at the start
of each line is unaffected. Control characters, line and paragraph separators,
and bidirectional-control characters are replaced with spaces, so a subject can
never span more than its own line.

No inputs or outputs changed, and the No Changes. sentinel is unchanged.

Staying on the previous format

v4.9.0
carries every security and dependency fix in this release -- including undici
7.29.0, which closes 12 advisories -- with the v4 output format untouched. Pin
metcalfc/changelog-generator@v4 to stay there. The v4 tag will keep moving
on the maintenance line.

What is in this release

Relative to v4.9.0, v5.0.0 adds only the escaping change. Both releases share
everything else:

• Render changelog subjects as literal text (#​475) -- v5 only
• Keep release tag names out of shell source (#​473)
• Verify release bundle before attestation (#​474)
• Bound the dependency overrides and clear the undici advisories (#​476)
• Stop bump:workflow rewriting pinned actions' provenance comments (#​477)
• Bump @vercel/ncc (#​470), eslint (#​472), globals (#​471), codeql-action (#​469)

Full history: v4.8.0...v5.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.