Changelog

• 7931832 Update dependency next to v16.2.3 [SECURITY] (#827)
• 3d211b6 ci: harden workflows and add security policy (#825)
• 57ccaab cli: add dump-ast parse mode (#824)
• d0ec1c2 prepare release v0.0.38 (#829)
• 888951c runtime: harden sandbox escape boundaries (#828)