v3.28.0

## What's Changed
* docs: add security policy and private vulnerability reporting by @iliaal in https://github.com/mvanhorn/last30days-skill/pull/1257
* docs: align CONFIGURATION.md with the engine, and add Opera to the cookie scan by @iliaal in https://github.com/mvanhorn/last30days-skill/pull/1263
* test: isolate the suite from the developer's last30days config by @iliaal in https://github.com/mvanhorn/last30days-skill/pull/1265
* fix(security): require https for the hosted API and keep local state owner-only by @iliaal in https://github.com/mvanhorn/last30days-skill/pull/1267
* feat: add dev.to as an opt-in keyless source by @iliaal in https://github.com/mvanhorn/last30days-skill/pull/1271
* fix(pipeline): stop adding jobs to host-supplied query plans by @mvanhorn in https://github.com/mvanhorn/last30days-skill/pull/1258
* fix(hackernews): link HN comment quotes to the comment, not the article by @mvanhorn in https://github.com/mvanhorn/last30days-skill/pull/1259
* fix(render): pluralize footer nouns ending in consonant+y by @mvanhorn in https://github.com/mvanhorn/last30days-skill/pull/1261
* fix(fusion): keep duplicate HN submissions of one URL apart by @mvanhorn in https://github.com/mvanhorn/last30days-skill/pull/1262
* fix(pipeline): fetch each identical source search once per run by @mvanhorn in https://github.com/mvanhorn/last30days-skill/pull/1260
* fix(rerank): weigh real engagement in fallback ranking by @mvanhorn in https://github.com/mvanhorn/last30days-skill/pull/1270
* fix(youtube): drop out-of-window videos on recent topics by @mvanhorn in https://github.com/mvanhorn/last30days-skill/pull/1266
* fix(github): keep pinned repos whose newest release predates the window by @mvanhorn in https://github.com/mvanhorn/last30days-skill/pull/1264
* chore(release): bump version to 3.28.0 by @github-actions[bot] in https://github.com/mvanhorn/last30days-skill/pull/1272


**Full Changelog**: https://github.com/mvanhorn/last30days-skill/compare/v3.27.3...v3.28.0