v0.3.2

Two fixes from a security review of the whole plugin, both in code an
organizer or a participant can reach.

Fixes

• The members-only gate on group registration now asks who is acting, not
  who created the registration. It exempted any registration an organizer
  had created, reading created_by_manager off the record — but a
  registration stays editable from the link in its confirmation e-mail with
  nobody signed in, so the exemption outlived the organizer's visit and the
  holder of that link could set a group plan on a form whose members-only
  switch was on. The carve-out is now core's management flag, which is what
  it always meant. The member discount's own trust in manager-created
  registrations is unchanged.

• scripts/sign-preview-pass.py no longer takes the Pass Type ID key's
  passphrase on the command line. --password put it in
  /proc/<pid>/cmdline, where any local account could read it while the
  script ran, and in the shell history of whoever followed the documented
  command.

If you script the preview signer

--password is gone. Set STSA_PASS_KEY_PASSWORD for an unattended run with
an encrypted key; run it interactively and it prompts. An unencrypted key
still signs with no prompt and no variable, exactly as before.

Full Changelog: v0.3.1...v0.3.2