Merge pull request #463 from basecamp/security/revision-and-upload

Authorize revision history and markdown uploads against current book access

Add changelog auto-generation

Version 1.2.0

## Security

- **Delete server-side session on logout** — @rosa
- **Sanitize markdown output in edit history and TOC edit views** (#392) — @djmb
- **Sanitize search results to prevent XSS from FTS5 output** (#420) — @flavorjones

Security-related dependency updates: rack, rack-session, uri, rails-html-sanitizer, nokogiri, addressable.

## Features

- **Markdown rendering for books and leaves** — appending `.md` to any book or leaf URL renders it as inline markdown — @dhh
- **YAML frontmatter in markdown views** — markdown output includes title, author, and URL metadata — @dhh
- **HTML link tags for markdown alternate format** — pages include `<link>` tags pointing to the markdown version — @dhh
- **Use relative links for uploaded files** — uploaded file URLs are now relative, improving portability — @kevinmcconnell

## Other

- Add README and license — @kevinmcconnell
- Add publish-image workflow for container releases — @kevinmcconnell
- Remove redundant dev credentials and old deployment configs — @kevinmcconnell
- Update fixtures to use example domain — @kevinmcconnell

Version 1.1.0

- Show table of contents in sidebar
- Allow searching inside books
- Update dependencies

Version 1.0.6

- Fix issue with forwarded headers when running behind an external proxy

Version 1.0.5

- Fix incorrect configuration when running without TLS (via Thruster
  update)
- Fix a typo in the Writebook Manual

Version 1.0.4

- Update to latest Thruster version
- Allow navigating between pages with a swipe gesture
- Fix incorrect icon on first run form

Version 1.0.3

- Ensure signed QR code links are URL safe
- Ensure text is visible on cover
- Improve images used in OpenGraph metadata
- UI adjustments for iOS
- Edits and improvements to Manual content
- Allow `summary` and `source` tags in Markdown

Version 1.0.2

- Fix broken link in `og:url`
- Refactor user profile links to simplify controller permissions
- Use signed links for QR code generation to prevent tampering

Version 1.0.1

- Ensure non-admin users can update their profile