Fix CHANGELOG.md to pass Keep a Changelog patch-version lint

[HeyItsGilbert]

Goal

The reusable CI workflow added in #497 (org powershell-ci.yml) runs mindsers/changelog-reader-action@v2 with validation_level: error against CHANGELOG.md, enforcing that patch releases (per SemVer) only contain Fixed/Security sections. This is the first time CHANGELOG.md (added in #494) has been linted, and it fails:

Only ''fixed, security'' sections are allowed for version 0.65.1.
Only ''fixed, security'' sections are allowed for version 0.65.2.
Only ''fixed, security'' sections are allowed for version 0.65.3.
Only ''fixed, security'' sections are allowed for version 0.66.1.
Only ''fixed, security'' sections are allowed for version 0.66.2.
0.67.1 entry is invalid.

Run: https://github.com/PowerShellOrg/PSKoans/actions/runs/35290428430/job/105431858210

Each flagged patch version (0.65.1, 0.65.2, 0.65.3, 0.66.1, 0.66.2, 0.67.1) currently has an ### Added section alongside/instead of ### Fixed, which predates this org convention.

Acceptance criteria

• Decide and apply a resolution for the flagged historical entries (e.g. re-categorize into Fixed where accurate, or document/justify an exception) without misrepresenting what actually shipped in those releases.
• ci / Run Linters (changelog validation step) is green in Replace legacy PSKoans CI with PowerShellOrg reusable workflow #488''s reusable CI workflow.

Blocks #488.