CHANGELOG entry for the whitelistable sandboxing change.

@gwprice OK?