[AUTO] Add release notes for 3.9.0

[opensearch-ci-bot]

Add release notes for 3.9.0

Borderline Calls

• Graduate resource sharing feature out of experimental #6348: Placed in Breaking Changes — the setting rename (plugins.security.experimental.resource_sharing.* → plugins.security.resource_sharing.*) has no deprecated fallback, making it a breaking change. Could also be considered an Enhancement (graduation of a feature).
• Use User directly as authenticated Subject #6419: Placed in Enhancements — removes an internal wrapper and simplifies the user model. Could be Refactoring, but it changes the public User class to implement Subject/Principal directly, which is a meaningful behavioral enhancement for downstream consumers.
• Return forbidden when API tokens feature is disabled #6351: Placed in Enhancements — returns 403 when feature is disabled. Could be Bug Fixes since the old behavior allowed creating unusable tokens, but the PR description frames it as adding a missing guard rather than fixing broken functionality.
• Restore ML model registration with security #6460: Placed in Bug Fixes — fixes a regression from Jackson 3 / Subject support that broke ML model registration.
• fix(audit): Add missing enable_standalone setting to StandaloneAuditB… #6372: Placed in Bug Fixes — fixes a test configuration issue, but it was blocking CI on main so it's more than just infrastructure.
• Copy scripts from tools to bin/ directory in assembly and make scripts agnostic to directory #6023: Placed in Enhancements — improves the packaging/installation experience for operators. Could be Infrastructure since it changes the build assembly, but the user-facing impact (scripts retaining executable permissions) is the primary value.
• Replace RestHighLevelClient with OpenSearch Java Client #6420, Replace RestHighLevelClient with OpenSearchClient usage in HttpClient #6489, Replace RestHighLevelClient with OpenSearchClient usage in SecurityAdmin #6492: Placed in Infrastructure — these replace an internal client library. Could be Maintenance or Refactoring, but the primary motivation is aligning with the OpenSearch ecosystem deprecation of RestHighLevelClient, and the changes are largely in test and tooling code.
• Switch from snakeyaml to snakeyaml-engine for YAML processing #6408: Placed in Infrastructure — switches YAML library to align with Jackson 3.x. Could be Maintenance since it's a dependency swap, but it's driven by an architectural change in OpenSearch core.
• Reject reserved JWT subjects #6494: Placed in Enhancements — adds a security hardening check. Could be Bug Fixes if the lack of validation is considered a vulnerability, but no specific exploit or issue was cited.
• Preserve authentication for self-referential CCS #6474: Placed in Enhancements — fixes self-referential CCS authentication. Could be Bug Fixes since it resolves [BUG] Cross Cluster Search to same node fails auth #5846, but the change is an identity-comparison improvement rather than fixing broken logic.
• fix(audit): dedup bulk audit events by only iterating BulkShardRequest #6390: Placed in Bug Fixes — deduplicates audit events. Clear bug fix.
• Group codeql updates together #6509: Placed in Infrastructure — groups dependabot PRs. This is a CI/build configuration change.
• Only provision Eclipse JDT formatter when running a spotless task #6438: Placed in Infrastructure — fixes CI flakiness. Could be Bug Fixes but it only affects the build system, not runtime behavior.

[DarshitChanpura]

#6513 This PR must be included here.