bump up to v0.4.0, add changelog

[bobcallaway]

consistently sets all code at v0.4.0 and once merged this commit can be tagged which will trigger the release process

[loosebazooka]

I thought we were keeping the spec version and library version in sync? Although I dunno how that's gonna be reasonable long term

[bobcallaway]

@haydentherapper thoughts?

[kommendorkapten]

No, the messages and releases are versioned independently, see RELEASE.md

Two of the messages, Bundle and TrustedRoot, are expected to be persisted and serialized to disk, and exchanged via other mechanisms such as the Sigstore TUF root. Therefore they contain a media_type. The media types are versioned, and so they must be updated appropriately according to semver. Each message SHOULD be versioned independently and so MAY differ from the targeted release. The media type represents the version of the message, not the release. Note that the media type does NOT capture the patch version, only major/minor.

[kommendorkapten]

Should we also remove the reference to JSON Schema in the release steps: https://github.com/sigstore/protobuf-specs/blob/main/RELEASE.md#json-schema

[kommendorkapten]

Thank you!

[haydentherapper]

Thanks!

[woodruffw]

LGTM, thanks @bobcallaway!