Tiled

Added
- Support partial download of an asset using the
[HTTP `Range` Header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Range).

Fixed
- When authenticated as a Service Principal, display the SP's uuid in
the client Context repr.
- The dependency `json-merge-patch`, introduced in v0.1.0b4, was missing from
some pip selectors.

Changed

- Minor implementation changes were necessary to make Tiled compatible with
Numpy 2.0.
- For improved security, the server-side array slicing function has been
refactored to avoid using `eval()`. To be clear: there were no known
exploitable vulnerabilities in the `eval()` approach. The input was validated
against a regular expression before being passed to `eval()`. However,
avoiding `eval()` altogether is better practice for defense-in-depth against
potential code injection attacks due to current or future bugs in Tiled or
its upstream dependencies.

Added

- Added a new HTTP endpoint, `PATCH /api/v1/metadata/{path}` supporting modifying
existing metadata using a `application/json-patch+json` or a
`application/merge-patch+json` patch.
- Added client-side methods for replacing, updating (similar to `dict.update()`),
and patching metadata.

Fixed

- Fixed regression introduced in the previous release (v0.1.0b1) where exceptions
raised in the server sent _no_ response instead of properly sending a 500
response. (This presents in the client as, "Server disconnected without
sending a response.") A test now protects against this class of regression.

Changed

- Customized default logging configuration to include correlation ID and username
of authenticated user.
- Added `--log-timestamps` CLI flag to `tiled serve ...` to opt in to including
timestamp prefix in log messages.

Added
- Support for `FullText` search on SQLite-backed catalogs

Fixed

- Updated `BaseClient.formats` to use the `dict` structure for specs.
- The `tiled serve directory --watch` function was not compatible with recent `anyio`

Fixed

- A dependency on `fastapi` was introduced in `tiled.adapters`. This has been
removed.