Upgrade CI workflows

[wagoodman]

This brings the latest CI patterns from syft into this repo, specifically:

• use a single bootstrap action and reuse in multiple jobs
• add make release target to trigger tagging to be done in the workflow (not locally)
• restricts GITHUB_TOKEN permissions to read only by default
• upgrades job runners to ubuntu 22.04
• replaces draft-only goreleaser config with direct-to-publish release workflow

This makes additional pattern changes:

• swaps to using annotated tags instead of lightweight tags
• swaps the chronicle version used in the pipeline to the current branch