Prep for 3.0.0 release

[w-goog]

Prepares for the 3.0.0 release: version bump and changelog. This release carries two source-breaking changes, so SemVer requires a major bump.

REVIEW NOTE: This PR includes a cherry-pick of #975, which is in review.

Here are the public-facing changes:

• Replace case range with explicit case labels in OIDTokenUtilities. #963 — explicit case labels in OIDTokenUtilities (issue Build fails with Xcode 26.4 #947)
• Update addressable gem to address CVE-2026-35611. Fixes issue #958. #965 — addressable gem bumped for CVE-2026-35611 (issue Upgrade addressable gem to 2.9.0 to fix CVE-2026-35611 (ReDoS) #958)
• Add Swift-specific argument label for resumeExternalUserAgentFlow #966 — Swift-specific argument label, resumeExternalUserAgentFlow(_:)
• Require resumeExternalUserAgentFlowWithURL:error: #970 — resumeExternalUserAgentFlowWithURL:error: made required
• Bump minimum versions for Xcode 27 support #972, Add Xcode 27 Preview to CI & Update tvOS Tests #973 — Xcode 27 minimum versions and CI

These changes are also included, though they are internal: #959, #960, #961 and #971 are CI runners, Node action versions, example bundle identifiers and gitignore entries.