Merge pull request #1082 from daverodgman/padding-ct-changelog-2.28

Backport 2.28: Add Changelog for CT fixes

ChangeLog.d/padding-ct-changelog.txt

@@ -0,0 +1,6 @@
+Security
+   * Improve padding calculations in CBC decryption, NIST key unwrapping and
+     RSA OAEP decryption. With the previous implementation, some compilers
+     (notably recent versions of Clang) could produce non-constant time code,
+     which could allow a padding oracle attack if the attacker has access to
+     precise timing measurements.