ci: publish the Docker image as publiccodeyml/libpubliccode only

fix: accept only relative paths and HTTP(s) URLs for referenced files

The check rejected only a lowercase "file:" prefix, so "FILE:///path"
made the parser look up that path on the host. Every scheme other than
HTTP(s) is now rejected, in any letter case.

ci: install Syft for release SBOMs

build: assign unique IDs to release SBOMs

ci(fix): checkout before setting up Go in release workflow

Checkout the repo, so the setup action can actually use the pinned toolchain
version from go.mod.

ci: pin Go toolchain from go.mod and add go mod verify

fix: set vcsurl.Client to respect --timeout for branch/GitLab detection

chore(ci): remove codecov until coverage is worth tracking (#328)

chore: update it/ipa_codes.txt (#287)

Co-authored-by: bfabio <[email protected]>

chore(deps): bump golang.org/x/crypto from 0.36.0 to 0.45.0 (#284)

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.36.0 to 0.45.0.
- [Commits](golang/crypto@v0.36.0...v0.45.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.45.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>