v1.4.0 — tag via the API

Fixes a failure that would have hit every repo eventually — the first two successes were luck.

What broke

VirtualWindow's release promoted both images correctly, then died pushing the tag:

! [remote rejected] v1.1.0 (refusing to allow a GitHub App to create or update
  workflow `.github/workflows/ggshield.yml` without `workflows` permission)

Since v1.1.1 the tag lands on the commit the image came from, so a version names code actually in it. That commit routinely predates a later CI change — and a token-authenticated push carrying a workflow file that differs from the default branch is refused. workflows is a PAT scope; GITHUB_TOKEN cannot be granted it, so no permissions change would have helped.

Topology and Atlas passed only because their tagged commits happened to carry workflow files identical to main's.

The fix

Create the tag through the git-data API. A tag object pointing at an existing commit introduces no file changes, so the restriction does not apply. Still annotated, same message, same commit — and the job no longer needs write access to the checkout to tag.

Minor: a behaviour fix with a mechanism change; callers do nothing.