docs: prep CHANGELOG + README for v0.4.0 release

[jcputney]

Summary

Satisfies the `release.yml` preflight gate so we can trigger the v0.4.0 release.

• CHANGELOG.md: rename existing Unreleased section → `[0.4.0] - 2026-05-20`; add bullets for the items that landed today (GHA-wrapper switch for OWASP DC, PR-time `dependency-review` workflow, `dependabot-auto-merge` workflow, jackson/slf4j/onnxruntime runtime bumps); update link footer.
• README.md: bump install snippets `0.3.0` → `0.4.0` (Maven, Gradle, magika-java-tika).
• pom.xml: untouched on purpose — `maven-release-plugin` will drop `-SNAPSHOT` itself at `release:prepare` time.

After this merges

1. Click Run workflow on `Release` (workflow_dispatch, ref: `main`).
2. Preflight → 3-OS verify → `mvn release:prepare + perform` (Maven Central publish) → SBOM collection → `attest-build-provenance` + `attest-sbom` → GitHub Release with CHANGELOG-extracted notes + JARs + per-module CycloneDX SBOMs.

Test plan

• All 8 required PR checks pass
• Preflight simulation already verified locally: CHANGELOG `## [0.4.0]` section present and non-empty, README references 0.4.0 (3x), no `` markers