docs: backfill missing CHANGELOG versions and fix SECURITY asset names

[laurentiu021]

Summary

Documentation accuracy fixes from the audit (docs-changelog + dist-01). No code, no release.

Changes

• CHANGELOG.md — backfilled the 5 released versions that had a git tag but no
  changelog entry, each placed in correct chronological order with content derived from
  the actual commits between tags:
  • 1.18.3, 1.18.1 (the 1.18 audit-fix line)
  • 0.47.1 (10 code-review findings), 0.35.12 (code-review batch 2)
  • 0.28.1 (Startup Manager scroll-crash fix, [Enhancement]: Monitor — Bandwidth Monitor (per-app network usage) #337)
• SECURITY.md — the "Verifying a release" section referenced SysManager.exe /
  SysManager.exe.sha256, but releases ship versioned assets
  (SysManager-v<version>.exe). Updated the filenames and the Get-FileHash example to
  match (README was already corrected for this in an earlier PR; SECURITY.md had lagged).

Verified, deliberately NOT changed

• README "30 tabs … 55 feature tabs, 25 WIP" — cross-checked against the nav tree: exactly
  55 nav items, 30 non-placeholder. Accurate, left as-is.
• ARCHITECTURE.md service table — the only items "missing" are interfaces
  (IPowerShellRunner etc.), which the doc intentionally covers in prose, not the
  concrete-service catalog. Left as-is.
• Keep-a-Changelog URL (/1.1.0/) — 1.1.0 is the current spec version. Not stale.

docs: → no release.