docs(changelog): add the #296 fragment

Author: allen0099

changelog.d/296.security.md

@@ -0,0 +1,14 @@
+**`@cache` no longer stores responses that belong to one caller.** A request
+with an `Authorization` header now bypasses the backend like `private=True`
+(RFC 9111 §3.5), unless the route is `public=True` or opts in with the new
+`cache_authorized=True`, meant for a `key_builder` that includes the verified
+caller's identity. A response whose own `Cache-Control` contains `private` or
+`no-store`, or that sets a cookie, is served but not stored, and the handler's
+`private`/`no-store` header is no longer replaced by the decorator's. A cookie
+response and a bypassed `Authorization` response are sent with `private` in
+place of `public` (keeping the other directives; `private, no-cache` on
+`no_cache` routes), so a CDN or proxy does not store them either;
+`must_revalidate=True` does not lift the bypass. Previously all three were
+stored and replayed to every caller, so one user's response could reach
+another. The per-user example in HTTP_CACHING.md ("Authenticated endpoints")
+now passes `cache_authorized=True`.