Update CHANGELOG for 8.2.5

[ci skip]

CHANGELOG

 Please view this file on the master branch, on stable branches it's out of date.
 
 v 8.2.5
-  - Fix a window.opener bug that could lead to XSS and open redirects
-  - Fix vulnerability that leaks private labels and milestones
   - Prevent privilege escalation via "impersonate" feature
-  - Prevent users from deleting Webhooks via API they do not own
-  - Prevent information disclosure via snippet API
+  - Prevent privilege escalation via notes API
+  - Prevent privilege escalation via project webhook API
+  - Prevent XSS via `window.opener`
+  - Prevent information disclosure via project labels
   - Prevent information disclosure via new merge request page
 
 v 8.2.4