Stable v2.9.9

• fix(nginx): /.well-known/ paths other than acme-challenge were 404ing
• fix(security-advisor): lead CRA view with the audience question, not bury it