Prepare tooling 0.9.0 release

[hdamker]

What type of PR is this?

documentation

What this PR does / why we need it:

Prepares the numbered tooling 0.9.0 release. It consolidates the changes that landed on main since v0.8.1 (milestone https://github.com/camaraproject/tooling/milestone/1, 24 items, 0 open):

• externalDocs validation against Design Guide §5.4 — new rules P-038 (repository URL) and P-039 (description) (Add externalDocs repository/description checks (P-038, P-039) #410)
• Bundler component-renaming-collision check — new rule P-040 (Add bundler component-renaming conflict check (P-040) #412)
• Show component/schema name in Spectral finding locations (feat(validation): show component name in Spectral finding location #404)
• Drop the @stoplight/spectral-rulesets pin (fix(deps): drop @stoplight/spectral-rulesets pin in validation/ #405)
• Suppress unactionable S-313 on the common pagination Link header (fix(rules): suppress unactionable S-313 on the common pagination Link header #406)
• Suppress unactionable S-313 on SinkCredential discriminator subtype fields (fix(rules): suppress unactionable S-313 on SinkCredential subtype fields #408)
• Suppress ANSI color in the bundling-failure annotation (fix(validation): suppress ANSI color in bundling-failure annotation #414)
• Align the per-API CHANGELOG's Commonalities/ICM dependency line with release-metadata.yaml (Align the CHANGELOG's Commonalities/ICM dependency line with release-metadata.yaml #416)
• Dependency bumps: @redocly/cli 2.39.0→2.43.2 (chore(deps): bump @redocly/cli from 2.39.0 to 2.41.0 in /validation #397, chore(deps): bump @redocly/cli from 2.41.0 to 2.43.2 in /validation #402), js-yaml 5.2.1→5.2.2 (chore(deps): bump js-yaml from 5.2.1 to 5.2.2 in /validation #398), brace-expansion and fast-uri security patches (fix(deps): bump brace-expansion to patched version in validation/ #400, fix(deps): bump fast-uri to patched version in validation/ #403)

Changes: VERSION.yaml → 0.9.0, a v0.9.0 CHANGELOG.md section, and a README release-information tag touch-up. Two new rule IDs (P-038/P-039) plus a third (P-040) make this a minor release, not a patch.

Which issue(s) this PR fixes:

Related to #419

Special notes for reviewers:

Numbered release PR — v1-rc is moved to the released commit after merge. Both regression canaries are green at HEAD (b1d6fc2): Validation Regression 12/12 PASS (run 31169997789), Release Automation Regression green (no RA-scope commits since the last green run). The one workflow-file change in scope (#414, NO_COLOR in validation.yml) is mechanical with no input/output contract change — canary-only gate accepted per the v0.7.0/v0.8.0 mechanical-change precedent.

Changelog input

Prepare tooling 0.9.0 release.

Additional documentation

This section can be blank.

NONE