Add CHANGELOG to package files

[patrickjaberg]

Hey @mtrudel, thanks for Bandit! 😄

Would you be open to adding the CHANGELOG to the list of files included in the hex package? I personally find it helpful when comparing package versions using the diff tool on hex.pm (specifically when there's a new release). If you're not opposed, I'll gladly PR the change. The current list of package files is:

["lib", "test", "mix.exs", "README*", "LICENSE*"]

Related, I was wondering if it was intentional (or still desirable) to include the test files in the package? If so, I'm curious to understand the rationale for doing so.

Finally, if you don't want to include the test directory, and do want to include the CHANGELOG, another option would be to remove the files: config entirely, and rely on the hex default for files:, which is:

[
  "lib",
  "priv",
  ".formatter.exs",
  "mix.exs",
  "README*",
  "readme*",
  "LICENSE*",
  "license*",
  "CHANGELOG*",
  "changelog*",
  "src",
  "c_src",
  "Makefile*"
]

See https://hexdocs.pm/hex/Mix.Tasks.Hex.Build.html#module-package-configuration

All of this also applies to thousand_island, where I'd be happy to PR the change as well if you'd like. Thanks for your consideration!

[mtrudel]

I have a vague memory that there was a reason that test was included in the list of distributed files, but I can't recall what it is (nor does a git blame on mix.exs yield anything useful).

I'd be up for removing the files section entirely! Happy to take PRs for here and Thousand Island.

Thanks for the issue!

[aptinio]

I now see the CHANGELOG.md in https://diff.hex.pm/diff/bandit/1.1.1..1.1.2. Thanks!

However, priv/plts/* got inadvertently included in the package, which are relatively big files:

> du -ah deps/bandit/priv/plts
4.0K    deps/bandit/priv/plts/dialyzer.plt.hash
1.3M    deps/bandit/priv/plts/dialyxir_erlang-26.1.plt
1.7M    deps/bandit/priv/plts/dialyxir_erlang-26.1_elixir-1.15.6.plt
3.0M    deps/bandit/priv/plts/dialyzer.plt
5.9M    deps/bandit/priv/plts

[mtrudel]

Reopening to track the pit fix