Bound runtime dependency ranges and pin build backend (#103)

* Bound runtime dependency ranges and pin build backend

Add version bounds to the runtime dependencies: requests was fully
unbounded and typing-extensions had no upper bound, so a fresh install
could resolve either to any just-published release. As a library,
socketdev declares bounded ranges rather than exact pins - exact pins
in package metadata would conflict with consumers that pin their own
dependencies, including socket-python-cli, which pins its entire
runtime closure (socketsecurity 2.5.10+) and relies on this package's
ranges staying compatible.

Floors match the versions already resolved and tested in uv.lock;
ceilings exclude the next major. Also pins the hatchling build backend
used for sdist builds. Dependabot (uv ecosystem, 7-day cooldown)
already keeps the lockfile fresh within these bounds.

Companion to the socket-python-cli dependency pinning work (CE-359).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Add CHANGELOG.md

Seed a changelog in the socket-python-cli format, starting at 3.4.3,
with a pointer to GitHub releases for earlier history.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Backfill changelog from GitHub release notes

Import all 53 published releases (v1.0.15 through v3.4.2) from the
auto-generated GitHub release notes: one dated entry per version,
pre-releases labeled, body headings demoted one level so version
headings stay the top-level structure.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Bump version to 3.5.0

The new requests floor is a newly binding constraint for consumers on
older versions, so this warrants a minor bump rather than a patch.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Fix static project version and use a Python 3.9-compatible hatchling

The [project] version in pyproject.toml is static ([tool.hatch.version]
is only consulted when version is declared dynamic), so bumping
version.py alone left the packaging metadata and uv.lock at 3.4.2.
Set the static version to 3.5.0 to match.

Pin hatchling to 1.27.0 instead of 1.31.0: 1.28+ requires Python 3.10,
while this package's requires-python still includes 3.9, so the newer
pin would break sdist builds on 3.9.

Addresses PR#103 review findings.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Declare the version dynamic so version.py is the single source of truth

Per review on PR#103: with dynamic = ["version"], hatchling reads
socketdev/version.py (the file version-check.yml already validates),
so packaging metadata can never drift from the checked version again.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: lelia