docs: add CHANGELOG entry for CVE-2026-5773 fix

Generated with [Linear](https://linear.app/sourcebot/issue/SOU-1504/sourcebot-devsourcebot-cve-2026-5773-curl-libcurl-wrong-file-transfer#agent-session-c22e8539)

Co-authored-by: linear-code[bot] <222613912+linear-code[bot]@users.noreply.github.com>

Author: linear-code[bot]

CHANGELOG.md

@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- Pinned `curl`/`libcurl` to `^8.20.0-r0` in the Docker image to address CVE-2026-5773. [#1447](https://github.com/sourcebot-dev/sourcebot/pull/1447)
+
 ## [5.1.1] - 2026-07-14
 
 - Add book a call button to sidebar. [#1441](https://github.com/sourcebot-dev/sourcebot/pull/1441)