v0.26.0

Every signed-in page carried the session's token in its HTML, and signing in with GitHub stored
GitHub's token where nothing used it, so anyone running a copy should update. GitHub's automation
also now moves an issue only when a pull request is about it. Updating a self-hosted copy applies one
D1 migration, which deletes those stored GitHub tokens, and needs no new setting; the protocol stays
at version 25. (#190, #191, #192)

Security

• Every signed-in page carried the session's token in its HTML, where a saved page or anything that
  keeps a copy of the document would have it too. The cookie is HttpOnly to keep it from there, and
  no page reads it, so pages no longer get it. Better Auth's /get-session still answers a script
  with it, so this keeps the token out of documents, not out of reach of a script already running in
  the page. (#190)
• Signing in with GitHub stored GitHub's access token, unencrypted, in account. Nothing read it:
  Track never acts for someone there, and its GitHub integration makes an exchange of its own. Track
  now keeps none of them, and a migration deletes the ones already stored. (#192)

Changed

• A pull request that only mentions an issue in its description links it and no longer moves it.
  An issue named to say it was out of scope used to go to In Review with no work done on it. The
  branch name, the title and a closing word such as "Fixes ENG-12" still move an issue, and a closing
  word added by a later edit moves it when the edit arrives. (#191)