v0.62.0

What's Changed

• State what app-only guards under oidc and dev by @mgoldsborough in #1928
• Bound the cost of matching a URI against resource templates by @mgoldsborough in #1931
• web: shell security headers, and telemetry drops URL queries by @mgoldsborough in #1930
• Bound resource-argument template matching, and cap matched URI length by @mgoldsborough in #1932
• Nest each app in a fixed frame page, so apps cannot read the shell's URL by @mgoldsborough in #1933
• Serve stored file bytes sandboxed, whatever NB_CSP says by @mgoldsborough in #1934
• Transient failures back off without auto-disabling a task by @mgoldsborough in #1935

Full Changelog: v0.61.0...v0.62.0