v5.3.0

What's Changed

• Add SECURITY.md and SUPPORTED_VERSIONS.md — vulnerability reporting via GitHub private reporting; 5.x fully supported, 3.x bug & security fixes only by @Erikmitk
• Split PHP Code Scanning CI into separate PHPStan and PHPUnit jobs by @Erikmitk
• Security: replace master-secret-in-URL with stateless HMAC preview tokens by @Erikmitk
• Refactor: extract DpfDocumentLoader trait and add Metadata landing-page plugin by @Erikmitk
• FIS-API POST: reject invalid enum values with descriptive error by @Erikmitk
• FIS-API GET: always return array for list-mapped fields by @Erikmitk
• Fix BibTeX author split for multiline and separators by @Erikmitk
• Fix undefined index notice in BibTeX mandatory field check by @Erikmitk
• Remove DOI and PPN when duplicating a document by @Erikmitk
• Fix Dependabot auto-merge: use --rebase instead of --merge by @Erikmitk
• Add Dependabot config and auto-merge CI by @Erikmitk
• Bump phpstan/phpstan from 2.1.51 to 2.2.1
• Bump galbar/jsonpath from 1.3.1 to 3.0
• Bump symfony/polyfill-intl-idn from 1.33.0 to 1.38.1

Full Changelog: v5.2.2...v5.3.0