This minor version of set_user includes the following important security fixes and changes:
- Fix security issues that let a session escalated by set_user() return to the original role without the reset token or crash the backend.
- Fix allowlist matching of group entries and match role names case-sensitively.
- Compare reset tokens in constant time.
- Remove support for PostgreSQL 13.
- Document the limits of the reset token.