[thomasnymand]

Completes the 3.3.1 (unreleased) section of RELEASE_NOTES.md with everything merged since 3.3.0:

• Fixes: REF-84 (OIOBPP ClassCastException, Attribute parsing error- http://digst.dk/oiosaml/basic_privilege_profile #68), already there.
• Dependencies: REF-83 Bouncy Castle bcprov-jdk18on 1.86 instead of bcprov-jdk15on 1.59 (with the note for applications that bring the old jar themselves), OpenSAML 3.4.6 with java-support 7.5.2, SLF4J API 1.7.36.
• Other changes: REF-83 Dependabot and dependency submission with the test/build updates; REF-85 demo IdP fix and renewed demo certificates.
• A short summary: drop-in replacement for 3.3.0, verified against NemLog-in DevTest4 on 2026-10-26 (login and logout with the demo SP on master f82d47b).

The resolved versions were checked with mvn dependency:tree on master. The release itself (version, tag, Maven Central, README version) follows doc/HOWTO_RELEASE.md in the release PR.