chore: release 3.17.0

[shreemaan-abhishek]

Description

Release 3.17.0.

This PR:

• Adds the 3.17.0 section to CHANGELOG.md (and its Table of Contents entry), covering all PRs merged to master since the release/3.16 branch was cut. Backward-incompatible changes are grouped under Change and marked with ⚠️.
• Bumps the version to 3.17.0 in apisix/core/version.lua and docs/{en,zh}/latest/config.json.
• Extends ci/check_changelog_prs.ts IGNORE_PRS for PRs that are not user-facing: a feature added and fully reverted within this release (feat(ai): support configurable request JSON library #13386, fix: normalize qjson errors in request json #13407, revert: drop configurable request JSON libraries #13449) and test-only / CI-only / docs-only changes whose subject prefix dodges the type filter (fix: prevent apisix_llm_active_connections gauge leak when plugin exits early via ngx.exit() #13139, fix(ci): replace blind sleep with health-check retry loops #13156, fix(ci): limit JVM heap for CI containers and replace pack with docker build #13157, fix: resolve flaky test cases causing CI instability #13158, feat(seo): optimize plugin titles and expand Getting Started guide #13222, feat(test): replace inline AI mock servers with fixture-based system #13234, chore(jwe-decrypt): fix lint caused by test numbering #13485).

Breaking changes (see the Change section)

• change(auth): require configured jwt claims, harden empty claims_to_verify and key-auth anonymous fallback #13468 jwt-auth: configured claims are now required; empty claims_to_verify no longer skips exp/nbf validation
• fix(jwt-auth): enforce algorithm match before signature verification #13182 jwt-auth: enforce algorithm match before signature verification (rejects algorithm-confusion tokens)
• feat(jwe-decrypt): remove server-side token generation endpoint #13464 jwe-decrypt: removed the server-side /apisix/plugin/jwe/encrypt token-generation endpoint
• fix(admin): require admin key for schema validate endpoint #13328 admin: the schema validate endpoint now requires an admin key
• feat(batch-requests): bound pipeline item count, timeout, and request schema #13492 batch-requests: bounded pipeline item count/timeout and tightened the request schema
• feat(hmac-auth): default signed_headers to ["date"] #13388 hmac-auth: signed_headers now defaults to ["date"]
• feat(cas-auth): sign request URI cookie and tighten cookie attributes #13331 cas-auth: signed request-URI cookie and tightened cookie attributes (new required cookie.secret)
• feat(proxy-cache): add consumer_isolation and cache_set_cookie options #13350 proxy-cache: consumer_isolation now defaults to true
• fix(tencent-cloud-cls): add ssl_verify option and fix shared state in cls-sdk #13194 tencent-cloud-cls: new ssl_verify option defaults to true (TLS verification now on)
• fix(security): TLS ssl_verify hardcoding and credential encryption issues #13203 security: TLS ssl_verify hardcoding fixes; ai-rag ssl_verify now defaults to true
• fix: resolve env vars before YAML parsing to preserve types in standalone mode #13078 standalone: env vars are resolved before YAML parsing, so unquoted ${{VAR}} placeholders now infer their type (number/bool) instead of always being strings

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes or the new features added to this PR
• I have added tests corresponding to this change (N/A: release bookkeeping only)
• I have updated the documentation to reflect this change
• I have verified that this change is backward compatible (if not, please discuss on the APISIX mailing list first; breaking changes are documented in the changelog)