chore(release): bump version to 0.9.3 and package release assets

- Add CHANGELOG entry for v0.9.3
- Bump version to 0.9.3 across Cargo.toml, Cargo.lock, THREAT_MODEL.md, SECURITY_AUDIT.md, Scoop, and WinGet manifests
- Package and sign Windows (.zip, .exe) and Linux musl (.tar.gz, sanctum) binaries with Minisign

packages/winget/HaraldPansi.Sanctum.yaml

@@ -1,6 +1,6 @@
 # yaml-language-server: $schema=https://aka.ms/winget-manifest.singleton.1.6.0.schema.json
 PackageIdentifier: HaraldPansi.Sanctum
-PackageVersion: 0.9.2
+PackageVersion: 0.9.3
 PackageName: Sanctum
 Publisher: Harald Pansi
 PublisherUrl: https://gitea.pansi.eu/harald
@@ -18,7 +18,7 @@ Tags:
   - webdav
   - container
   - plausible-deniability
-ReleaseNotesUrl: https://gitea.pansi.eu/harald/sanctum/releases/tag/v0.9.2
+ReleaseNotesUrl: https://gitea.pansi.eu/harald/sanctum/releases/tag/v0.9.3
 Installers:
   - Architecture: x64
     InstallerType: zip
@@ -26,7 +26,7 @@ Installers:
     NestedInstallerFiles:
       - RelativeFilePath: sanctum.exe
         PortableCommandAlias: sanctum
-    InstallerUrl: https://gitea.pansi.eu/harald/sanctum/releases/download/v0.9.2/sanctum-v0.9.2-windows-x86_64.zip
-    InstallerSha256: 5828fca32b7d0581b740ef4f3cfb21c3717f92ee80d2e3f62e953a1ef083ac18
+    InstallerUrl: https://gitea.pansi.eu/harald/sanctum/releases/download/v0.9.3/sanctum-v0.9.3-windows-x86_64.zip
+    InstallerSha256: 75611155008ed0ecd6e6bbbb77fc549c5884ecc5779ca3012e66852bbb3b729b
 ManifestType: singleton
 ManifestVersion: 1.6.0