v0.3.2

Fixed

• Use Gitea /src/commit/ URLs when pin: commit is enabled.
• Tighten forge hostname autodetection heuristics for self-hosted forges.
• Strip a trailing .git suffix from repo_url when building forge URLs.
• Always initialize _view_ref in on_config so partial config does not leave the plugin in a
  broken state.
• Parse GitLab-style edit_uri branch segments when resolving the documentation branch.

Changed

• Add OpenSSF Best Practices (Metal Passing), Baseline Level 1, and Scorecard badges to the README
  and documentation site; run OpenSSF Scorecard analysis with SARIF upload to Code Scanning.
• Document a 14-day initial security response SLA and explicit security contacts in SECURITY.md.
• Create signed release tags (git tag -s); the publish workflow rejects unsigned or unverified tags
  before PyPI upload.
• Add MIT, CI, and Python badges to the docs home page; exclude MkDocs snippet files from standalone
  page builds.

Full changelog: v0.3.1...v0.3.2