WebCalendar v1.9.19

Maintenance release fixing a broken release zip (missing htmlsanitize.php) and an MCP token priority bug, plus dependency updates.

Changed

• Bump twbs/bootstrap-icons from 1.10.5 to 1.13.1 (#554)
• Bump actions/checkout from 6 to 7 (#650)
• Bump actions/cache from 5 to 6 (#661)

Fixed

• includes/htmlsanitize.php was missing from the release zip; added to release-files manifest (#662)
• MCP: X-MCP-Token header now takes priority over MCP_TOKEN env var for token extraction

Verifying this release

WebCalendar releases ship a signed manifest. See docs/release-signing.md for verification instructions.