Bump the package version to 2.4.0 (setup.cfg, docs/conf.py) and finalize
the changelog entry for the release.

This release exposes RocksDB's encryption-at-rest framework: databases
can be opened through an encrypted environment via
rocksdb.EncryptionProvider (loads any provider registered in
librocksdb), rocksdb.EncryptedEnv, the new Options.env attribute and an
env= parameter on BackupEngine. The binding ships no cryptography of
its own; stock RocksDB bundles only a test-grade CTR/ROT13 provider,
which emits a UserWarning — real at-rest security needs an AES provider
compiled into librocksdb (e.g. the encfs or ippcp plugins). The env a
DB is opened with is pinned by the DB and env reassignment on in-use
Options is refused, so an env can never be freed while still in use.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>