v2.11.7

## Changelog

Refer to the [2.11 Upgrade Guide](https://docs.nats.io/release-notes/whats_new/whats_new_211) for backwards compatibility notes with 2.10.x.

### Go Version

- 1.24.5 (#7047)

### Dependencies

- golang.org/x/crypto v0.40.0 (#7061)
- golang.org/x/sys v0.34.0 (#7061)

### Added

General

- The `SubjectMatchesFilter` function is now available as an exported function for embedded use (#7051)
- The `leafz` monitoring endpoint now includes the connection ID (#7063)
- The monitoring endpoint index page now includes the endpoint names on hover (#7066, #7087)

### Improved

JetStream

- Consumers with inactivity thresholds should no longer age out before processing acks (#7107)
- The Raft layer will no longer request store state on each apply (#7109)
- Tombstones in Raft log compactions will now be written asynchronously, similar to purges (#7109)
- When enabling per-message TTLs on a stream, existing messages with the `Nats-TTL` header are now scanned and processed (#7117)

### Fixed

General

- Message header lookups with common prefixes will now return correctly in all cases, fixing a problem where the headers could be sensitive to ordering (#7065)
- Validate that the `default_sentinel` JWT is a bearer token for auth callout (7074)
- The `$SYS.REQ.USER.INFO` endpoint should now only be answered by the local server, fixing cases where the endpoint may sometimes return without full connection details (#7089)

JetStream

- The Raft layer will require recovery and snapshot handling at startup before campaigning for a leadership election, fixing a situation where a node could continue with an outdated stream (#7040)
- The Raft log will no longer be compacted until after a snapshot is written, improving crash resilience (#7043)
- A race condition when shutting down Raft nodes which could result in no snapshot being written has been fixed (#7045)
- Consumer pull requests that use `no_wait` or `expires` behaviour has been fixed with replicated consumers (#7046)
- Pull consumers with an inactive threshold will now consider pending acks when determining inactivity, preventing the consumer from being deleted while messages are being processed (#7052)
- Push consumers will now correctly error when trying to configure priority groups (#7053)
- Committed entry objects will now be correctly returned to the pool on error, reducing allocations (#7064)
- The time hash wheel used for per-message TTLs now correctly detects and expires messages with TTLs over an hour, previously it could take double the expected time (#7070)
- A potential panic when selecting message blocks during TTL recovery has been fixed (#7072)
- A KV purge operation with subject delete markers configured will no longer leave behind a redundant extra delete marker (#7026)
- Raft will now correctly attempt to truncate back to a snapshot if applies were not caught up instead of resetting the entire log (#7095)
- Store cipher conversion will now work correctly when combined with store compression (#7099)
- Truncate and erase operations in the filestore should now be consistent after a hard kill (#7100)
- When a filestore message block is deleted and an unclean shutdown results in a stale `index.db`, the deleted blocks are now correctly marked as lost data and the index is rebuilt (#7123)
- Fixed a potential underflow that could happen when modifying `max_bytes` reservations (#7131)

Tests

- Tests have been improved (#7031, #7036, #7050, #6728, #7096)

### Complete Changes
 
https://github.com/nats-io/nats-server/compare/v2.11.6...v2.11.7