Fix invalid SBOM and provenance action pins

[MelbourneDeveloper]

TLDR

Replace nonexistent SBOM and provenance action commits with the verified commits for the same upstream versions.

What Was Changed or Deleted?

• Correct anchore/sbom-action v0.21.0, actions/attest-build-provenance v3.0.0, and actions/attest-sbom v3.0.0 pins in both native release workflows.
• Correct the same provenance pin in the retained VSIX workflow.
• Keep the action versions, inputs, permissions, build, signing, and publication behavior unchanged.

How Do The Automated Tests Prove It Works?

• Existing pins reproduce GitHub HTTP 422 commit lookup failures and the native jobs’ setup errors.
• Replacement commits resolve successfully and match the exact upstream release tags.
• A parsed YAML inventory checked all 23 external workflow action references; these were the only invalid pins.
• actionlint passes for all three changed workflows.
• Literal make ci passed after the edits (session 29390).
• Pi reviewed the repair and found no blockers.

Breaking Changes

• None.