mention json-c 0.12 support in ChangeLog (due to json-c security issue)