Bump version and CHANGELOG for v3.40.0

[DrJosh9000]

v3.40.0 (2022-11-08)

Full Changelog

Added

• Agent binaries for windows/arm64 #1767 (@yob)
• Alpine k8s image #1771 (@dabarrell)

Security

• (Fixed in 3.39.1) A security issue in environment handling between buildkite-agent and Bash 5.2 #1781 (@moskyb)
• Secret redaction now handles secrets containing UTF-8 code points greater than 255 #1809 (@DrJosh9000)
• The update to Go 1.19.3 fixes two Go security issues (particularly on Windows):
  • The current directory (.) in $PATH is now ignored for finding executables - see https://go.dev/blog/path-security
  • Environment variable values containing null bytes are now sanitised - see syscall, os/exec: unsanitized NUL in environment variables golang/go#56284

Changed

• 5xx responses are now retried when attempting to start a job #1777 (@jonahbull)
• 🧹 A variety of dependency updates and cleanups!

[tessereth]

Looks great! Just a couple minor comments.

[triarius]

🎉🎉🎉