release: v0.4.4

[justlevine]

What

This PR updates the REST_Controller to prevent a malicious authenticated user from setting the jwt_secret_key to ******** and therefore hiding the fact that the JWT's been compromised.

Why

Identified by Rapid7 and reported responsibly and with a fix + test case by @M-GRV . Thank you!🏆

How

See diff

Testing Instructions

1. Be a user with manage_options
2. send an authenticated POST to the settings endpoint with ********
3. See it just fails silently and the old secret remains it's self.

Additional Info

Checklist:

• My code is tested to the best of my abilities.
• My code follows the WordPress Coding Standards.
• My code has proper inline documentation.
• I have added unit tests to verify the code works as intended.
• I included the relevant changes in CHANGELOG.md

[Copilot]

Pull Request Overview

Security patch release preventing masked JWT secret value from overwriting the real secret and routine version/dependency bumps.

• Adds masking constant and attempt to sanitize inbound secret updates.
• Introduces test to ensure masked secret cannot overwrite stored secret.
• Version, dependency, and documentation updates for release 0.4.4.

Reviewed Changes

Copilot reviewed 10 out of 12 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
wp-graphql-headless-login.php	Version and compatibility metadata bumped.
src/Admin/Settings/RestController.php	Adds masking constant and sanitization logic; restructures route registration.
src/Model/Client.php	Refactors docblock, removes explicit $data property annotation, adds phpstan generics.
src/Auth/Request.php	Minor formatting cleanup.
tests/wpunit/SettingsRestControllerTest.php	Adds test ensuring masked secret values do not overwrite actual secret.
composer.json	Updates wp-cli dependency.
readme.txt	Updates stable tag and tested WP version.
README.md	Updates release badge to 0.4.4.
CHANGELOG.md	Adds 0.4.4 release notes.
phpstan/constants.php	Syncs version constant for static analysis.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[justlevine]

I'll fix CI later.