CHANGELOG: add notice about password concurrency limit

CHANGELOG.md

@@ -10,6 +10,8 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
   setting this environment variable would result in a max retries of 2,
   regardless of the value set.
   ([PR](https://github.com/hashicorp/boundary/pull/5385)).
+* Fix an issue where, when starting a session, the connection limit always displays 0.
+  ([PR](https://github.com/hashicorp/boundary/pull/5396)).
 
 ### New and Improved
 
@@ -24,11 +26,14 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
     dual-stack support, this Boundary release may consume more memory. From our
     testing, the increase seems to be around 1.6x, however this
     may vary depending on your deployment architecture.
+* Add concurrency limit on the password hashing of all password auth methods.
+  This avoids bursty memory and CPU use during concurrent password auth method
+  authentication attempts. The number of concurrent hashing operations
+  can be set with the new `concurrent_password_hash_workers` configuration
+  value in the controller stanza, or the new 
+  `BOUNDARY_CONTROLLER_CONCURRENT_PASSWORD_HASH_WORKERS` environment variable.
+  The default limit is 1.
 
-### Bug fixes
-
-* Fix an issue where, when starting a session, the connection limit always displays 0.
-  ([PR](https://github.com/hashicorp/boundary/pull/5396)).
 
 ## 0.18.2 (2024/12/12)
 ### Bug fixes