v1.2.0

What's Changed

• fix(build): stop an unstamped build reporting version 1.0.0 by @teoritty in #83
• fix(security): require the master password to weaken plugin trust by @teoritty in #84
• fix(security): verify every plugin release asset and resolve its entry by path by @teoritty in #85
• fix(security): take the host key decision from the session, not the caller by @teoritty in #86
• fix(security): gate non-loopback forward binds and verify the real bound address by @teoritty in #88
• fix(security): pin the SSH algorithm policy and refuse weak host keys by @teoritty in #87
• fix(security): rate-limit master password attempts by @teoritty in #89
• fix(security): stop a plugin raising its own resource limits by @teoritty in #90
• fix(security): name the filesystem paths a plugin asks for at install time by @teoritty in #91
• fix(security): revoke a plugin's capability grants when it is uninstalled by @teoritty in #92
• fix(security): refuse a plugin download redirect that drops TLS by @teoritty in #93
• fix(security): remove a plugin's files when its install is refused by @teoritty in #94
• fix(security): require checksums when loading a user-installed plugin by @teoritty in #95
• fix(security): strip terminal control characters from plugin log lines by @teoritty in #96
• fix(security): bound how many plugin requests the host handles at once by @teoritty in #97
• fix(security): stop an unrecognised apply target widening a recursive chmod by @teoritty in #100
• fix(security): refuse remote entry names that lie about what they are by @teoritty in #98
• fix(security): bound how far a remote directory walk will recurse by @teoritty in #101
• fix(security): bound the transfer concurrency and timeout settings by @teoritty in #102

Full Changelog: v1.1.0...v1.2.0