Ensure release can only run from specific SHA

[pingtimeout]

This PR includes multiple improvements to release workflows so that they are more robust and more user-friendly:

First, it contains an update the second release workflow so that it sets the project version to a final version only when RC=0. This condition also determines it updates the changelog as it is unnecessary to call the gradle task for RC ≥ 1.

Second, it changes the run criteria for the third workflow that builds and stages artifacts. Now that workflow MUST be run from an RC tag. It cannot be run from a release branch anymore. This change is required because of an unexpected scenario: when the same SHA is used to cut multiple RC. Then the order of git tags is unknown and the command that was used to find the current tag is non-deterministic. With that change, the problem cannot happen anymore as the release manager must specify the exact RC tag that is used.

Finally, the fourth workflow that publishes artifacts after a vote passes contains a new safety check. When the workflow is run, it verifies that it is running on a release/[major].[minor].x branch and that the head of that branch corresponds to the last RC tag. That second condition ensures that no new commit has been added since the vote started for the last RC. It is necessary because part of publishing involves rebuilding Polaris Docker images, so the source code must be identical to the RC. This fixes #3290.

The PR includes an update to the release guide to reflect those changes. It also contains a change just for consistency. The e-mail templates used to reference the Polaris version as x.y.z-rci but the x element is also used in the release branch name as a letter (e.g. release/1.3.x) which is confusing. All occurrences of x.y.z and rci have been replaced by [major].[minor].[patch] and rc[N].

Testing has been done with dry-run mode and can be verified with those runs:

• When the third release workflow is run from a release branch, it fails with the message ❌ Workflow must be run from a release candidate tag, not a branch. Current ref: refs/heads/release/99.98.x. Please select a release candidate tag (e.g., apache-polaris-1.0.0-incubating-rc0) from the 'Use workflow from' dropdown in the GitHub UI.
• When the fourth release workflow is run but commits have been pushed to the release branch after the RC was cut, it fails with the message: ❌ Current HEAD (4a46dbf0f5f37a42ac645344f2115a925d1a8468) does not match RC tag apache-polaris-99.98.0-incubating-rc1 (1ef2eda8720e8957e5df421401fa0db955a03bd8).
• When the fourth workflow is run normally, the check passes with the message ✅ Current HEAD matches RC tag apache-polaris-99.98.0-incubating-rc2

[snazy]

LGTM!

I think 2 regex pattern should be adjusted, but not a blocker for this PR.

[snazy]

Suggested change

	local rc_tag_pattern="apache-polaris-${major}.${minor}.*-incubating-rc*"
	local rc_tag_pattern="apache-polaris-${major}\.${minor}.[0-9]+-incubating-rc[0-9]+"

[snazy]

Suggested change

	local tag_pattern="apache-polaris-${version_without_rc}-rc[0-9]+"