v2.12.8

## Changelog

Refer to the [2.12 Upgrade Guide](https://docs.nats.io/release-notes/whats_new/whats_new_212) for backwards compatibility notes with 2.11.x.

### Go Version

- 1.25.9

### Dependencies

- golang.org/x/crypto v0.50.0 (#8030)
- golang.org/x/sys v0.43.0 (#8030)
- github.com/nats-io/nats.go v1.51.0 (#8068)

### Improved

JetStream

- Refactored and simplified setting the pinned headers in consumers (#8032)
- Scanning for the starting sequence for consumers is now an asynchronous operation which no longer pauses the metalayer (#8051)

### Fixed

General

- Reload logic on gateway `pinned_certs` configuration has been corrected
- Repeated `CONNECT` messages on a connection now clear subscriptions
- JWT claims with validity times that cross midnight are now validated correctly
- The `/connz` monitoring endpoint no longer discloses bearer JWTs
- Monitoring redaction of route and cluster URL secrets when passed in as command line arguments
- Fixed a panic that could occur when negotiating compression on leafnode connections
- Max control line enforcement for non-clients has been fixed
- Fixed a bug where setting message headers could mutate the input message buffers

Leafnodes

- Solicited leafnode connections now send a connect advisory, which was previously missing (#8015)

JetStream

- Message roll-ups are now applied on interest-based streams where there is no interest over the subjects (#8019)
- Stream leaders can now catch up from incoming snapshots, correcting an edge case when scaling up (#8021)
- Fixed a Raft commit index reset when terms mismatch (#8023, contributed by @thecitymouse)
- Purging via scheduled `Nats-Schedule-Next: purge` now errors when message scheduling is not enabled (#8035)
- Recovering with a legacy zero index Raft snapshot will no longer panic (#8039)
- Messages with a deduplication `Nats-Msg-Id` header are no longer incorrectly deduplicated in mirrors (#8043)
- Fixed a panic when scaling after a stream update when the assignment is not fully populated yet on recovery (#8049)
- Stream info and consumer info requests will no longer return not found when the assignments are in-flight (#8054)
- Streams and consumers now correctly reject path separators in asset names
- Fixed a concurrent map write panic when calling the consumer pause endpoint (#8061)
- The cluster stream sequence is no longer incorrectly advanced when a proposal fails, avoiding a `last sequence mismatch` error (#8057)
- Stream clustered consistency checks are now performed on transformed subject where applicable instead of the publish subject (#8022)
- Stream sourcing should no longer duplicate messages after a leafnode reconnection or after a proposal error (#8069)

### Complete Changes
 
https://github.com/nats-io/nats-server/compare/v2.12.7...v2.12.8