fix: Security hardening follow-ups and 0.3.0 changelog

[nfebe]

Follow-ups that landed after #142 was merged:

• Mount ownership chowns symlinks themselves instead of following them. The pass runs as root over container-written content, so a planted link could get any host file chowned to the container user. Closes Mount ownership pass follows symlinks while chowning as root #143
• Alphanumeric secret characters are drawn uniformly instead of with a biased modulo. Closes Generated secrets use modulo-biased alphanumeric encoding #144
• 0.3.0 changelog entry

[sourceant]

Code Review Summary

This PR focuses on security hardening and the 0.3.0 release preparations. It addresses a potential host file ownership vulnerability and ensures cryptographic uniformity in secret generation.

🚀 Key Improvements

• Mitigated symlink attacks by switching from os.Chown to os.Lchown in internal/docker/discovery.go.
• Eliminated modulo bias in alphanumeric secret generation by using cryptoRand.Int in internal/api/server.go.
• Added a regression test for symlink handling during mount ownership application.

💡 Minor Suggestions

• Consider consolidating buffer allocation in the secret generator if more encodings are planned.

[sourceant]

Review complete. No specific code suggestions were generated. See the overview comment for a summary.