update CHANGES with latest merges

Author: lifeforms

CHANGES

@@ -15,6 +15,7 @@ New functionality:
  * Add PUBLIC identifier for XML entities (#1490) (Rufus125)
  * Add .rdb to default restricted_extensions (Walter Hop)
  * Add rule 933200 PHP Wrappers (Andrea Menin)
+ * Add send-payload-pls.sh script to test payload against multiple paranoia levels (Christian Folini)
  * Add support for shell evasions with $IFS (Walter Hop, Chaim Sanders)
  * Add unix-shell commands (Christoph Hansen, Chaim Sanders)
  * Also inspect the path for the script tag (Federico G. Schwindt)
@@ -55,6 +56,7 @@ Fixes and improvements:
  * Add CVE-2018-11776 to comments of 933160 and 933161 (Franziska Bühler)
  * Add CVE-2018-2380 to comments of rules (Franziska Bühler)
  * Add CVE numbers for Apache Struts vulnerabilities to comments in rules (Franziska Bühler)
+ * Add default env vars for anomaly scores in Docker (Franziska Bühler)
  * Added spaces in front of closing square brackets (Franziska Bühler)
  * Adding travis changes (#1316) (Chaim Sanders)
  * Add missing OWASP_CRS tags to 921xxx rules (Walter Hop)
@@ -63,6 +65,7 @@ Fixes and improvements:
  * Also handle dot variant of X_Filename. PHP will transform dots to underscore in variable names since dot is invalid. (Federico G. Schwindt)
  * Bring back CRS 2.x renumbering utility (Walter Hop)
  * Clean up travis and reorg (Federico G. Schwindt)
+ * Code cosmetics: reorder the actions of rules (Ervin Hegedus)
  * Content-Type is case insensitive (Federico G. Schwindt)
  * Disassembled 941160 (Franziska Bühler)
  * Drop separate regexp files. They are not really needed and save us from updating multiple places. (Federico G. Schwindt)
@@ -77,6 +80,7 @@ Fixes and improvements:
  * Fix commit default for non 2.9 branch (Chaim Sanders)
  * Fix CRS2->CRS3 mapping table (973344 -> 941100) (Chaim Sanders)
  * Fix date (Chaim Sanders)
+ * Fix Docker image SSL support (Franziska Bühler)
  * Fix duplicate .env (jschleus, Chaim Sanders)
  * Fix executing paranoia level counters (Christian Folini)
  * Fix indentation and python version in crs2-renumbering script (Chaim Sanders)