Add 8.12.11 and 8.12.12 CHANGELOG items

[ci skip]
Signed-off-by: Rémy Coutable <remy@rymai.me>

CHANGELOG

 Please view this file on the master branch, on stable branches it's out of date.
 
+v 8.12.12
+  - Replace MR access checks with use of MergeRequestsFinder
+  - Reenables /user API request to return private-token if user is admin and request is made with sudo
+
+v 8.12.11
+  - No changes
+
 v 8.12.10
   - Fix information disclosure in `Projects::BlobController#update`
   - Fix missing access checks on issue lookup using IssuableFinder