refactor: make release.yml a pure reusable workflow with bump support

[felickz]

Summary

Separates self-specific release logic from the reusable workflow and adds bump input support.

release.yml (reusable workflow)

• Removed workflow_dispatch trigger — now purely workflow_call
• Added bump input (patch/minor/major) that auto-increments from latest GitHub release tag
• Both version and bump are supported with clear priority:
  • version provided → use it (explicit always wins)
  • bump provided → look up latest release, increment semver
  • Both provided → warning, uses version
  • Neither → error with helpful message
• Backwards compatible — existing callers passing version work unchanged (e.g., codeql-extractor-action)

self-release.yml

• Added workflow_dispatch with bump choice (patch/minor/major)
• Uses patch-release-me to bump .release.yml and opens a PR
• Push-to-main path unchanged: reads .release.yml, passes version to reusable workflow

Caller examples

Simple bump (no .release.yml needed):

jobs:
  release:
    uses: advanced-security/reusable-workflows/.github/workflows/release.yml@main
    with:
      bump: patch

Explicit version (existing pattern):

jobs:
  release:
    uses: advanced-security/reusable-workflows/.github/workflows/release.yml@main
    with:
      version: "2.3.0"

Prerelease bump:

jobs:
  release:
    uses: advanced-security/reusable-workflows/.github/workflows/release.yml@main
    with:
      bump: minor
      prerelease: true

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

• .github/workflows/release.yml