This pull request introduces a new approach for building release artifacts for the s390x architecture by offloading the build process to a remote s390x host via SSH, and makes several related improvements to the CI pipeline and packaging scripts. It also adds a security section to the changelog documenting recent dependency upgrades for CVE mitigation.

**s390x Build Pipeline Improvements:**

* Added a new script `build-release-artifacts-s390x.sh` that handles building on a remote s390x host using SSH, including automated SSH key retrieval from Vault, remote script execution, and artifact transfer.
* Updated `.semaphore/semaphore.yml` to use the new remote build script for s390x builds, set required environment variables for SSH, and clean up the SSH key after use. Removed the previous in-container build and the GSSAPI-enabled build job.

**Packaging and Build Script Enhancements:**

* Modified `build-release-artifacts.sh` to always remove Docker containers after use by adding `--rm` to the Docker run command, improving resource cleanup.

**Security Documentation:**

* Added a "Security considerations" section to `CHANGELOG.md` documenting OpenSSL and libcurl CVE fixes via dependency upgrades.

**Windows Packaging Fix:**

* Fixed a typo in `win32/package-zip.ps1`, copying the correct `zstd.dll` instead of a duplicate `z.dll`.