Bump github.com/transparency-dev/merkle from 0.0.1 to 0.0.2

[phbnf]

upgrade transparency-dev/merkle from v0.0.1 to v0.0.2

Checklist

• I have updated the CHANGELOG.
• I have updated documentation accordingly (including the feature implementation matrix).

[roger2hk]

github.com/transparency-dev/merkle was updated to 0.0.2 by Dependabot in #2990, so this is no longer needed.

[phbnf]

Interestingly enough, it did not update CHANGELOG.md, facepalm.

[roger2hk]

I usually see the Dependabot updates in the generated release notes.

[phbnf]

Yeah but I think the goal of CHANGELOG.md is to keep track of noteworthy updates, which I believe this one was. I would not expect all the dependencies updates to be in CHANGELOG.md for instance. Or maybe we want? They were added for v1.5.1 for instance. Clarity in the PR checklist and release documentation would help here, to clarify whether:

• one should update the CHANGELOG.md for dependecy updates
• whether we want CHANGELOG.md to contain all the change, or only noteworthy ones

[roger2hk]

According to our internal team doc, the CHANGELOG.md is expected to include any non-trivial (or trival but noteworthy) changes. The merkle dependency is a trival but noteworthy change, so it's good to include it.

[phbnf]

Good, I've put them there with the release notes.