Update CHANGELOG.md for 12.9.0

[ci skip]

changelogs/unreleased/refactor-bypass-session-admin-mode.yml

----
-title: Sessionless and API endpoints bypass session for admin mode
-merge_request: 25056
-author: Diego Louzán
-type: changed

changelogs/unreleased/refactor-disable-csrf-in-session-destroy.yml

----
-title: Disable CSRF protection on logout endpoint
-merge_request: 25521
-author: Diego Louzán
-type: changed

changelogs/unreleased/remove-cs-kubernetes-workaround.yml

----
-title: Remove kubernetes workaround in container scanning
-merge_request: 21188
-author:
-type: changed

changelogs/unreleased/remove-duplicate-auth-refresh-on-project-create.yml

----
-title: Remove duplicate authorization refresh for group members on project creation
-merge_request:
-author:
-type: performance

changelogs/unreleased/remove-merged-branch-names-ff.yml

----
-title: Improve performance of Repository#merged_branch_names
-merge_request: 26005
-author:
-type: performance

changelogs/unreleased/remove-puma-notices-from-admin-area-banner.yml

----
-title: Remove Puma notices from AdminArea banner
-merge_request: 26137
-author:
-type: changed

changelogs/unreleased/replace-undefined-with-unknown.yml

----
-title: Replace undefined severity with unknown severity for occurrences
-merge_request: 26085
-author:
-type: other

changelogs/unreleased/replace-undefined-with-unkown-vulnerabilities.yml

----
-title: Replace undefined severity with unknown severity for vulnerabilities
-merge_request: 26305
-author:
-type: other

changelogs/unreleased/replace_checkbox_by_toggle_for_modsecurity.yml

----
-title: Replace checkbox by toggle for ModSecurity on Cluster App Page
-merge_request: 26720
-author:
-type: changed

changelogs/unreleased/repository-contributors-group-by-email.yml

----
-title: Group repository contributors by email instead of name
-merge_request: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/26899
-author: Hilco van der Wilk
-type: changed

changelogs/unreleased/requirements-model.yml

----
-title: Add migration for Requirement model
-merge_request: 26097
-author:
-type: added

changelogs/unreleased/rk4bir-master-patch-60164.yml

----
-title: Migrated from .fa-spinner to .spinner in 'app/assets/javascripts/notes.js
-merge_request: 24916
-author: Raihan Kabir (gitlab/rk4bir)
-type: changed

changelogs/unreleased/rk4bir-master-patch-77755.yml

----
-title: Migrated from .fa-spinner to .spinner in app/assets/javascripts/blob/template_selector.js
-merge_request: 25045
-author: Raihan Kabir (gitlab/rk4bir)
-type: changed

changelogs/unreleased/rk4bir-master-patch-85217.yml

----
-title: Migrated from .fa-spinner to .spinner in app/assets/javascripts/create_merge_request_dropdown.js
-merge_request: 24917
-author: Raihan Kabir (gitlab/rk4bir)
-type: changed

changelogs/unreleased/rk4bir-master-patch-92247.yml

----
-title: Migrated from .fa-spinner to .spinner in app/assets/javascripts/sidebar/components/assignees/assignee_title.vue
-merge_request: 24919
-author: rk4bir
-type: changed

changelogs/unreleased/rk4bir-master-patch-97031.yml

----
-title: Migrated the sidebar label select dropdown title component spinner to utilize GlLoadingIcon
-merge_request: 24914
-author: Raihan Kabir
-type: changed

changelogs/unreleased/rs-commit-web_url.yml

----
-title: Add web_url attribute to API response for Commits
-merge_request: 26173
-author:
-type: added

changelogs/unreleased/rs-keep-divergent-refs-column.yml

----
-title: Add keep_divergent_refs to remote_mirrors table
-merge_request:
-author:
-type: other

changelogs/unreleased/rs-remote-mirrors-docs.yml

----
-title: Add remote mirrors API
-merge_request:
-author:
-type: added

changelogs/unreleased/sarnold-format-timestamps-locally.yml

----
-title: Fix timezones for popovers.
-merge_request: 24942
-author:
-type: fixed