docs(changelog): add the restore-from-Git entry (#2656)

The branch had never added one, though the convention here is one bullet
per PR in the same commit as the code.

One entry for the whole feature rather than one per commit - it has not
shipped yet, so the review rounds are refinements of an unreleased thing
rather than fixes to a released one. For the same reason the per-category
permissions are written as what to grant, not as something that changed.