v0.28.0

First release of dirigent-contrib: block packs for dirigent that reach outside systems, Chap (dirigent_contrib.chap) and the open climate service (dirigent_contrib.climate). Requires dirigent 0.28.0.

Since the packs moved here, both carry the fixes from their first security review: ids held to one plain path segment, credentials that cannot be sent refused at validation, max_response (64MB) and request_deadline (10m) on both connections, asset hrefs read only under base_url, a CSV observation limit, and answers of the wrong shape refused rather than read as empty.