[AUTO] Add release notes for 3.8.0

[opensearch-ci-bot]

Add release notes for 3.8.0

Borderline Calls

• Onboard new backport-pr re-usable github workflow (custom-codecs) #349: Placed in Enhancements due to the "enhancement" label, though it could also be Infrastructure since it's a CI workflow change.
• Update maven2 mirror repository url order #352: Placed in Enhancements due to the "enhancement" label, though it could also be Infrastructure or Maintenance since it's a build configuration change.
• Upgrade qat-java to 2.5.0 and batch decompression into a single JNI call #357: Placed in Enhancements — this is a dependency upgrade combined with a performance optimization (batching JNI calls). Could be Maintenance (dependency bump) or Refactoring (internal rework), but the performance improvement aspect makes Enhancements the best fit. No matching label was present, so fallback analysis was used.
• Update opensearch-build workflow references from commit SHA to main #346: Placed in Infrastructure via fallback message analysis since it modifies CI workflow references and had no categorizable labels.

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit 4beb444.

Path	Line	Severity	Description
release-notes/opensearch-custom-codecs.release-notes-3.8.0.0.md	9	high	Dependency version change: qat-java upgraded to 2.5.0 (PR #357). Per mandatory rule, all dependency version changes must be flagged for maintainer verification regardless of apparent legitimacy — artifact authenticity cannot be confirmed from release notes alone.
release-notes/opensearch-custom-codecs.release-notes-3.8.0.0.md	8	high	Maven2 mirror repository URL order changed (PR #352). Reordering package registry sources can redirect dependency resolution to a different mirror, enabling dependency confusion or substitution attacks if a malicious package is present at the newly prioritized source.
release-notes/opensearch-custom-codecs.release-notes-3.8.0.0.md	13	high	GitHub Actions workflow references changed from pinned commit SHAs to the mutable 'main' branch (PR #346). This is a known CI/CD supply chain attack vector: unpinned branch references allow the upstream workflow repository to inject arbitrary code into the build pipeline at any future point without a corresponding change in this repo.

The table above displays the top 10 most important findings.

Total: 3 | Critical: 0 | High: 3 | Medium: 0 | Low: 0

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🧪 No relevant tests

🔒 No security concerns identified

✅ No TODO sections

🔀 No multiple PR themes

⚡ No major issues detected