Update the release build to satisfy the compliance requirement

[daxian-dbw]

PR Summary

1. Move only Component Governance Detection step to before signing. This is because signing cert authorization requires this step to be done even without signing.
2. Update package reference to use stable versions of package references.

PR Checklist

• PR has a meaningful title
  • Use the present tense and imperative mood when describing your changes
• Summarized changes
• Make sure you've added one or more new tests. No Applicable
• User-facing changes
  • Not Applicable
  • OR
  • Documentation needed at PowerShell-Docs
    • Doc Issue filed:

Microsoft Reviewers: Open in CodeFlow