publish email: Include changelog info for the published version

[kevmoo]

now that we can parse the changelog, it'd be great to get the changelog details for the published release!

[jonasfj]

We send these emails to enable package owners to discover malicious publishing events, in case their account is compromised.

Allowing a potential attacker to define a section of the email is probably not a huge concern. As coming up with a fake/innocent CHANGELOG entry can be hard.

But we should note that the purpose of these emails is not to notify people who are interested in updates about a package.

[kevmoo]

But we should note that the purpose of these emails is not to notify people who are interested in updates about a package.

Yup. But I've noticed that these end up being FYI emails that someone else on my team has published something. I end up clicking and going to the changelog to see what's new

[isoos]

Duplicate of #2028, closing this.