v0.0.19

## What's Changed
* fix(security): land the 0.0.18 coordinated security release by @DavidBabinec in https://github.com/CoreBunch/Instatic/pull/478
* feat(release): runnable server artifacts and a batch of shared fixes by @DavidBabinec in https://github.com/CoreBunch/Instatic/pull/479
* fix(plugin-sdk): carry contentAccess from definePlugin config into the manifest by @mostafasadeghidev in https://github.com/CoreBunch/Instatic/pull/333
* feat(plugins): give the sandbox a CSPRNG by @lovepixel-git in https://github.com/CoreBunch/Instatic/pull/390
* fix(site-import): honour alt text, script order, folders, and re-imports by @DavidBabinec in https://github.com/CoreBunch/Instatic/pull/480
* fix(import): keep the content a compound button wraps by @m-altaifi in https://github.com/CoreBunch/Instatic/pull/476
* chore(dev): install dependencies before the dev servers start by @DavidBabinec in https://github.com/CoreBunch/Instatic/pull/481
* feat(plugin-sdk): ingest managed media from plugins by @DavidBabinec in https://github.com/CoreBunch/Instatic/pull/487
* test(e2e): repair two specs left behind by security fixes by @DavidBabinec in https://github.com/CoreBunch/Instatic/pull/492
* fix(media): route storage upload plans through the SSRF-safe fetch guard by @DavidBabinec in https://github.com/CoreBunch/Instatic/pull/517
* fix(runtime): decide path containment with relative(), not a string prefix by @DavidBabinec in https://github.com/CoreBunch/Instatic/pull/518
* chore(release): prepare 0.0.19 by @DavidBabinec in https://github.com/CoreBunch/Instatic/pull/519

## New Contributors
* @m-altaifi made their first contribution in https://github.com/CoreBunch/Instatic/pull/476

**Full Changelog**: https://github.com/CoreBunch/Instatic/compare/v0.0.18...v0.0.19