- The updated ServerNonce was not saved after activate_session, which
  means that subsequent activate_sessions would fail with
  BadIdentityTokenInvalid.
- The _username and _password attributes of Client were never updated but
  checked in the code (_add_user_auth function).

- sign token with algorithm from policy uri
- verify signature in server!

Don't allow plaintext password to prevent BadSecurityModeInsufficient in some clients

in uaprotocol_hand.py

According to the specification, "[t]he Historizing attribute indicates
whether the Server is actively collecting data for the history of the
Variable. [...] Default value is FALSE."

Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.9.0 to 1.10.3.
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](https://github.com/pypa/gh-action-pypi-publish/compare/ec4db0b4ddc65acdf4bff5fa45ac92d78b56bdf0...f7600683efdcb7656dec5b29656edb7bc586e597)

---
updated-dependencies:
- dependency-name: pypa/gh-action-pypi-publish
  dependency-type: direct:production
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

It hasn't been in use for SecurityPolicy None