feat(ci): add sfw-enterprise support and publish-without-sfw escape hatch

When SOCKET_API_KEY is set, downloads sfw-enterprise from
SocketDev/firewall-release instead of sfw-free. Enterprise shims
include additional ecosystems (gem, bundler, nuget, go on Linux).
SSL workaround only applies to sfw-free.

Adds publish-without-sfw input to provenance workflow to bypass
firewall shims during publishing.

Author: jdalton