v1.5.0

What's Changed

• ci: cut Actions spend ~80% on pull requests by @Animesh-Sri-bugb in #84
• pentest: use a code graph for route discovery and reachable-sink ranking by @Animesh-Sri-bugb in #85
• pentest: limit a run to a route allowlist (--only-routes / --only-route) by @Animesh-Sri-bugb in #86
• pentest: read @flows to the verb's definition; keep route channels whole by @Animesh-Sri-bugb in #87
• pentest: refresh the vendored guardlink @flows conformance corpus by @Animesh-Sri-bugb in #88
• pentest: tolerate richer guardlink SARIF, accept graph answers verbatim, stop weighting URL-guessed classes by @Animesh-Sri-bugb in #89
• pentest: read guardlink's declared context and test each declared boundary by @Animesh-Sri-bugb in #90
• pentest: read route access, untested reach, entry reach and reachable advisories from the code graph by @Animesh-Sri-bugb in #91
• pentest: test a boundary whose direction is declared, including one between two declared assets by @Animesh-Sri-bugb in #92
• docs(security): report vulnerabilities to security@bugb.report by @Shahid-BugB in #93
• docs: set crate homepage to https://cxg.bugb.io by @Shahid-BugB in #94
• engine/go: build templates with third-party imports in a private module by @Shahid-BugB in #95
• pentest: don't read an unmodelled guardlink rule as mitigated; prep 1.5.0 by @Animesh-Sri-bugb in #96

Full Changelog: v1.4.0...v1.5.0