[pcai]

Bump to 1.4.0 and record the changelog entry.

This is the first release since 1.3.3 (2024-02-13). Since then three
functional changes have landed, all backwards compatible:

• Signed WS-Security timestamps (Update of Added ability to add signed timestamp to header #47): Signature.new accepts a
  timestamp: true option (plus optional created_at/expires_at)
  that adds a wsu:Timestamp to the Security header and covers it
  with its own digest Reference, so the timestamp cannot be altered
  without invalidating the signature.
• InclusiveNamespaces handling when verifying signatures (Adds handling of InclusiveNamespaces configuration #46).
• Signature-verification fixes for multi-token documents and signed
  attachments (Fix signature verification for multi-token documents and signed attachments #62): the signer certificate is now selected via the
  SecurityTokenReference instead of always taking the first
  BinarySecurityToken, and cid: attachment references can be
  verified against caller-supplied decrypted_attachments.