Release 0.5.0

Changed

• Sighting source for public channels is now the canonical
  https://t.me/<username>/<msg_id> link — clickable from
  Vulnerability-Lookup straight to the originating Telegram message.
  Private channels (and any case where the channel URL says "public"
  but the username field is missing or doesn't match the Telegram
  username rule) still get the deterministic Telegram/<aes-siv>
  identifier so chat ids and message ids are never exposed in the
  clear. The asymmetry is intentional: public sources double as a
  human-followable link, private sources stay opaque.

  Migration note: sources for public-channel sightings produced by
  0.4.x were AES-SIV ciphertexts; from 0.5.0 they're plaintext URLs.
  Previously-pushed sightings will not dedupe against new ones for the
  same public message.