[SizzleUnrlsd]

Release 0.11.0 adds one change, #152.

• code-injection (Detection: a code-injection rule for attacker input reaching eval, exec and other CODE sinks #152). The new rule reports attacker input that reaches the code eval or exec runs, with the same verdicts as the other taint rules. The eval and exec sinks now read the code argument only: the globals and locals passed with it are data. dangerous-eval still reports every call to eval or exec. The regression corpus gains three findings, each reviewed as a true positive.

The Enterprise templates table needs this release. It treats Jinja2, Flask and Mako template sources as CODE sinks (CoreTrace-Entreprise/coretrace-python-analyzer-plugins#3), and without this rule those sinks report nothing.

Changes in this PR

• Version: bumped in pyproject.toml, coretrace_python.__version__, the release test, and the three version examples of the usage guide: the JSON report, its tool.components, and the VEX tooling.
• CHANGELOG.md: the Unreleased section is dated as 0.11.0. No entry changed.

Verification

• pytest: 1122 passed (build installed, so the wheel tests run too).
• pytest -m regression under Python 3.12: 19 passed.
• ruff check on the tracked files and mypy: clean.

Tag v0.11.0 after merge to publish.