4.95v Security updates

Bump LHC_RELEASE from 494 to 495 and document the 4.95v release in the changelog.

🔒 Security (primary focus):

• 🌐 Pin resolved IPs via CURLOPT_RESOLVE for outbound bot REST API requests to defeat DNS rebinding; reject loopback/private/reserved ranges and redirects; add rest_api_limit config (deny_local default true, allow_host).
• 🖼️ Require authenticated operator session for external image zoom and reject non http/https and private/reserved destinations; harden file downloads against SSRF.
• ⏳ Bound REST API session token lifetime (session_token_expire, default 30 days) with isExpired(), expires_on stamping, revocation on use, and stricter loginbytoken/notifications token validation.
• 🔑 Bind sessions and remember-me cookies to password hash via hash_equals() so password changes invalidate all sessions/tokens.
• 🛡️ Restrict cron.php to CLI, whitelist cronjob/extension options with realpath confinement; whitelist user import field mapping; validate theme import attributes and image uploads.
• 💉 Use var_export() for inlined translations/config and skip values that could form <? tags to prevent PHP code injection via stored config.
• ✅ Add CSRF/permission checks to lhwebhooks dispatch, copyautoresponder, transferuser, canned message subject, saveonlinenotes, addonlineoperation, addsubjectbytemplate, changemailbox, apifetchmails, deleteconversation and loadview; limit group chat invites to private-group members; enforce assignment permissions and self-edit restrictions.
• 🧼 Sanitize referrer/session referrer/footprint/current page URLs to block unsafe schemes; add getSafeReferer() to prevent open redirects.
• 🧱 Strip visitor [html_snippet]/[html] blocks, cast snippet/message IDs to int, validate ID arrays before SQL IN clauses, and use bound values in abstract filters.
• 🗂️ Cast archive/chat/role/user IDs to int and validate fetched objects before use; guard preview/print/sendmail with is_object; render explicit permission error in abstract/edit; validate react-to-message id and require write access.

✨ Functional improvements:

• 🤖 Expose latest matched condition as {bot_condition.*} via new MatchedConditions helper with "Expose matching variables" checkbox; clearer condition debug; bot closechat/setdepartment also update related mail conversation; extend bot detection list with Meta crawlers and make matching case-insensitive; log PHPMailer send failures.
• 🎨 Render admin widget theme preview in Shadow DOM using real widget CSS bundle for accurate parity with live widget; use resolved theme id for single-message re-render.
• 📧 Add in-context help texts and grouping for mailbox follow-up/re-open/default operator/department options; remove tracking pixel URLs from HTML and plain text on import.
• 🔎 Add User ID filter to user list search; fix proactive invitation "Any" department selection with validated multi-dropdown; clarify standard queue priority labels with hints.

ℹ️ No new DB migration script required for this release.

What's Changed

• fix(widgetrestapi): use the resolved theme id when re-rendering a single message by @VincentBorgers in #2418

New Contributors

• @VincentBorgers made their first contribution in #2418
• @admin-del Security reports
• @kah-ja Security reports

Full Changelog: 4.94v...4.95v