Fix Release workflow: drop disallowed SLSA provenance job

[AndreyVMarkelov]

Problem

Pushing the v3.6.1 tag produced a startup_failure — the Release workflow never ran. Annotation:

The reusable workflow slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0 is not allowed in dropbox/dbxcli because all reusable workflows must be from a repository owned by your enterprise or match one of the allowed patterns.

GitHub validates reusable-workflow references at load time, so the disallowed provenance job failed the entire workflow before any job started. No v3.6.1 release or artifacts were produced.

This was the first tag to exercise the new supply-chain release.yml (SLSA/SBOM/Cosign added after v3.6.0), so it was never validated against org policy.

Fix

• Remove the provenance job and its orphaned SLSA subject-generation steps + slsa_subjects_file output.
• Keep SBOM generation (anchore/sbom-action) and Cosign signing (sigstore/cosign-installer), which are step-level actions, not reusable workflows.
• Update CHANGELOG to say "SBOM generation and Cosign signatures" (drop the SLSA provenance claim).

Follow-up (optional)

To restore SLSA provenance later, an org/enterprise admin would need to add slsa-framework/slsa-github-generator to the allowed reusable-workflows list.

Release steps after merge

Re-point the existing v3.6.1 tag to the merge commit and force-push it to re-trigger the Release workflow.