docs(changelog): rewrite [Unreleased] for the Linux admin audience

The Unreleased block had drifted into developer-centric territory
(internal refactors, CI/tooling mechanics, CONTRIBUTING prose,
example-plugin skeleton changes, ruff/bandit/pre-commit housekeeping,
dev-facing CHANGELOG entries for things admins never see).

Strip the flat top sections that were accumulating developer-internal
entries, merge the surviving admin-relevant fixes into the existing
topic-grouped structure, and reword them from admin perspective:

- "Monitoring Plugins / Fixed" gains entries for the audit fixes from
  #1070 that affect plugin output, perfdata, state decisions or
  crashes: axenita-stats, deb-updates, hin-status, keycloak-version,
  mysql-memory, mysql-table-locks, network-connections,
  nextcloud-security-scan, ntp-w32tm, openstack-swift-stat,
  openvpn-version, php-status, qts-temperatures, redis/valkey-status,
  rocketchat-stats, sap-open-concur-com, starface-java-memory-usage,
  updates, wildfly-memory-usage, wildfly-non-xa/xa-datasource-stats.
  Each entry leads with the user-visible symptom, not the code shape.
- "Monitoring Plugins / Changed" mentions the DESCRIPTION / --help /
  README polish once, and calls out the plugin-group README links
  pointing at the docs site.
- "Icinga Director / Changed" records the check2basket `notes_url`
  switch that admins see in the Service Template.
- "Build, CI/CD / Added" drops run-unit-tests / run-static-checks /
  tox.ini entries and keeps only the MkDocs site + SLE 15/16 packages.
- New "Security" subsection: one-liner summarizing the bandit audit
  without listing internal annotations.

Dropped entirely (no admin impact): CI tooling setup, pre-commit hook
changes, ruff/bandit/vulture adoption notes, all CONTRIBUTING entries,
`example` skeleton changes, tools/run-*-tests flags, tox sdist fix,
GitHub Actions SHA pinning, metabase-stats per-file-ignore, and the
various structural-only refactors that do not change any observable
output.

Author: markuslf