[SizzleUnrlsd]

Release 0.7.0 is a precision release. It follows the #98 measurement.

• Guard rule. A guard makes a flow a hotspot only when it examines what the sink receives, so request.method == 'POST' no longer lowers the vulnerability behind it (Precision: a guard counts only when it examines a value the sink depends on #135). Ten corpus findings go back to HIGH; each was reviewed as a real vulnerability.
• SSRF. The SSRF sinks of Requests and httpx read the request destination only, by position or url= (Precision: SSRF sinks of HTTP clients read the destination only #128).
• Django templates. render_to_string escapes when the analyzer can establish that the project's template does (Precision: establish Django template autoescaping before clearing render_to_string output #130).
• Django token and URLs. csrf.get_token and reverse carry no attacker choice (Precision: Django's CSRF token and reversed URLs carry no attacker choice #132).

Users will see more HIGH-confidence findings behind method checks, and fewer false SSRF, XSS and open-redirect findings. The cache format moved from 8 to 9 in this release, so existing caches are recomputed on the first run.

Changes in this PR

• Version: bumped in pyproject.toml, coretrace_python.__version__, the release test and the report example of the usage guide.
• CHANGELOG.md: the Unreleased section is dated as 0.7.0. Its four entries are ordered by reach, the guard rule first, instead of by merge order. No entry text changed.

Verification

• pytest: 1065 passed.
• pytest -m regression under Python 3.12: 19 passed.
• ruff check src tests and mypy are clean.

Tag v0.7.0 after merge to publish.