chore: release 2.3.0

[scops]

Summary

Cuts the 2.3.0 release after three additive features merged since 2.2.0 (allowlist override, rate limiting, SBOM workflow). All changes are backward-compatible, hence a minor bump.

Changes in this PR

• package.json → 2.3.0.
• openapi.json → info.version: "2.3.0" (the contract test enforces the sync).
• CHANGELOG.md: the four Unreleased entries are promoted under ## [2.3.0] - 2026-05-10, and the link list at the bottom is updated.

What's in 2.3.0

• Configurable allowlist via ALLOWLIST_FILE (refactor: extract allowlist to lib/ with ALLOWLIST_FILE override #18).
• Opt-in rate limiting via RATE_LIMIT_RPM (feat: opt-in per-IP rate limiting on /validate via RATE_LIMIT_RPM #19).
• CycloneDX SBOM generated and attached to every release (chore: generate and attach CycloneDX SBOM to every release #20).

Test plan

• npm test — 48/48 (the version-sync test confirms openapi.json matches package.json).
• CI green.
• After merge: tag v2.3.0, create the GitHub Release using the 2.3.0 CHANGELOG section. The new SBOM workflow will trigger automatically and attach sbom.cdx.json to the release.
• Backfill SBOM for v2.2.0 via Actions → SBOM → Run workflow → tag: v2.2.0.