[SizzleUnrlsd]

Release 0.12.0 adds three changes, #155, #157 and #158.

• Module-level names (Detection: module-level names bound through another instance resolve in functions #155). A module-level name bound to an attribute, an item or a call of another module-level name now resolves in functions, as the same value does in a function body. A query built from request data and executed through a module-level sqlite3 or psycopg2 cursor used to go unreported. The regression corpus is unchanged.
• Members model (Plugins: a Members model types what an object gives by attribute or item #157). A new model type says what the attributes and items of a class's instances give. With it, every path to a pymongo collection denotes the collection class, whatever the database and collection names, so one sink covers client.shop.users.find, client["shop"]["users"].find and the getters. Symbol resolution reads these models through the new semantic.members input.
• nosql-injection (Detection: a nosql-injection rule for structured attacker input #158). The new rule reports attacker input that may hold a structure reaching a NOSQL sink. Text input carries TEXT_KINDS, every kind but NOSQL: form fields, headers, URL parameters, the command line, the environment, and entry-point parameters annotated with scalars. A flow now names each origin once, whatever kinds the parameters of one entry point carry. The engine ships no NOSQL sink.

The Enterprise mongodb table needs this release. It declares the pymongo, Motor and Flask-PyMongo sinks with Members models (CoreTrace-Entreprise/coretrace-python-analyzer-plugins#3), and an older engine cannot import Members.

Changes in this PR

• Version: bumped in pyproject.toml, coretrace_python.__version__, the release test, and the three version examples of the usage guide: the JSON report, its tool.components, and the VEX tooling.
• CHANGELOG.md: the Unreleased section is dated as 0.12.0. No entry changed.

Verification

• pytest: 1174 passed (build installed, so the wheel tests run too).
• pytest -m regression under Python 3.12: 19 passed.
• ruff check on the tracked files and mypy: clean.

Tag v0.12.0 after merge to publish.