v1.9.0

Add a CHANGELOG so a consumer can decide whether to bump

This library is consumed by services in more than one product and released by git tag, so what each tag changes needs to be readable without walking the log. Matches the format the other libraries here already use: newest first, versions are tags, written for whoever bumps the dependency.

v1.9.0 is written out properly, because it is the release where a reader most needs the detail: the app instance id and what it is not (unauthenticated telemetry, never an authorization input, never a metric label), the failure hook and the three parts of its contract that follow from running synchronously inside the error path, and the three behaviours that arrive on bump with no opt-in -- the correlation_id span attribute on every request, the new log field, and CorrelationOptions returning up to two options instead of one.

Earlier tags are backfilled from git history and say so, rather than pretending to have been written at the time. Each backfilled claim was checked against the tag it describes.

Docs only -- build and tests unchanged and green.