Fix release titles/notes and close leftover Trivy S3 alerts

[eschultink]

Summary

• Release workflow was using github.ref (refs/tags/v1.0.0) as the tag and title; it now uses the tag name and CHANGELOG-based notes (features / fixes / breaking changes, no Contributors section).
• v1.0.0 added optional versioning and logging, but Trivy still flags the bucket because those resources are count = 0 at defaults. Ignore AVD-AWS-0090 / AVD-AWS-0089 the same way encryption is ignored, and skip scanning examples/ so the registry copy is not reported twice.

Fixes

Code scanning alerts that should close after this lands on main and Trivy re-uploads SARIF:

• S3 Data should be versioned (AVD-AWS-0090) — main.tf
• S3 Bucket Logging (AVD-AWS-0089) — main.tf
• S3 Data should be versioned (AVD-AWS-0090) — registry copy
• S3 Bucket Logging (AVD-AWS-0089) — registry copy

Change implications

• dependencies added/changed? no

Test plan

• Confirm a dry run of scripts/generate-release-notes.sh v1.0.0 emits Breaking / Features / Changes and no Contributors
• After merge, confirm the Trivy workflow SARIF upload closes the four alerts above
• Spot-check README / examples/basic-remote now pin ~> 1.0.0

Made with Cursor