docs(changelog): v1.0.23 security baseline

[bilbospocketses]

First PR through the new PR-gated workflow. Records the security baseline pass under [Unreleased] in CHANGELOG.md ahead of the v1.0.23 tag cut.

Summary

• Adds the v1.0.23 security baseline entry to [Unreleased]: Added (6 items) + Changed (2 items) + Security (7 items) + Notes (3 items).
• Captures the LICENSE-absence decision deferral, the Trusted Signing v1.1.0 deferral, and the gh api PATCH array-field lesson learned mid-execution.

Test plan

• build-and-test CI status check goes green (sole purpose of this PR is to validate the new ruleset works end-to-end before tagging).
• Squash-merge cleanly via gh pr merge --squash --delete-branch.
• No SHA-pinning enforcement errors in the CI run.
• No allowed_actions denial errors.