chore: release 4.3.1

[oc-tmueller]

Release preparation for the ownCloud 11.0.1 line.

The reason to cut this: no released version of the app carries the return-URL validation
yet. v4.3.0 was tagged 2026-07-20 at #613 and #620 landed after it.

Contents of 4.3.1

• Security — fix: only navigate to a validated absolute http(s) return URL #620, the validated return URL and the narrowed WOPI post-message origin
• Fixed — the pnpm settings move (fix(deps): move pnpm settings out of package.json into pnpm-workspace.yaml #631) and the lockfile regeneration that closed all
  dependency alerts (fix(deps): regenerate the pnpm lockfile and bump eslint, closing all alerts #624)
• Changed — the JS unit test harness (test: add a javascript unit test harness for the classic frontend #623), the appstore removal (build: drop the appstore target in favour of dist #634), the signed
  release and distribution-scan workflows (ci: add signed release workflow #616, ci: scan the distribution tree for known vulnerabilities #617), the community health files (docs(ospo): community health rollout v2 — README, agents.md, health files #601),
  translations (chore: update translations from transifex #618), 4.2 Dependabot coverage (chore: give the 4.2 maintenance branch Dependabot coverage #626) and dependency bumps (chore(deps-dev): bump prettier from 3.9.5 to 3.9.6 in the minor-and-patch group #615, chore(deps-dev): bump vue from 3.5.40 to 3.5.42 in the minor-and-patch group across 1 directory #628, chore(deps-dev): bump the minor-and-patch group with 3 updates #636)

Two backfilled changelog sections

CHANGELOG.md's newest entry was [4.2.2], so the file was missing two shipped versions:

• [4.3.0] shipped with no changelog entry at all. Summarised from the 48 commits between
  v4.2.2 and v4.3.0 rather than enumerated — OC11 support (feat: support OC11 #573), PHP 8 (feat: php8 #579), dbal 3
  compatibility (fix: doctrine/dbal 3 compatibility #574), the federation-allowlist fix (feat(security): use richdocuments.federation_allowlist system config for federation server validation #599), the Dependabot alert sweep (fix(deps): resolve all 78 open Dependabot alerts #605)
  and the CI moves.
• [4.2.3] was only ever recorded on the 4.2 branch, so master's history skipped it.

Following the recent convention, neither new section gets a compare-link definition — the link
block at the bottom of the file has been stale since [4.2.0], and [4.2.1]…[4.2.3] have
none either. Tidying that up is its own change.

Verification

make dist in owncloudci/php:8.3 produces a 171-entry, 248 kB tarball, unchanged in
shape from the pre-bump tree. appinfo/info.xml reads 4.3.1, so the reusable workflow's tag
check will pass for v4.3.1.

Tagging follows once this is merged. The 11.0.1 server-release spec pin is handled separately.

[phil-davis]

I suppose that the 4.2.4 changelog might get merged into here at some stage, or just left in the 4.2 branch commit list.