Pin GoReleaser version to v2.14.3 in all workflows (#4333)

<!-- CURSOR_AGENT_PR_BODY_BEGIN -->
## Summary

Resolves ENG-2676.

Pins the GoReleaser version from `latest` to the exact version `v2.14.3`
in all workflow files that use `goreleaser/goreleaser-action`, and adds
a Renovate custom regex manager so version bumps are proposed
automatically.

## Changes

### Version pinning

All three `goreleaser-action` usages had `version: latest` replaced with
`version: "v2.14.3"`:

| File | Usage |
| --- | --- |
| `aws-source/module/provider/.github/workflows/release.yml` | Terraform
provider release |
| `cli/.github/workflows/release.yml` | CLI release |
| `.github/workflows/ci.yml` | CI dry-run build |

Each location includes a `# renovate: datasource=github-releases
depName=goreleaser/goreleaser` comment hint above the `version:` line.

### Renovate support

A new custom regex manager was added to `.github/renovate.json` that:
- Scans `**/.github/workflows/*.yml` (covering root, `cli/`, and
`aws-source/module/provider/` workflow directories)
- Matches the `# renovate:` comment + `version:` line pattern
- Uses the `github-releases` datasource for `goreleaser/goreleaser`

This means Renovate will automatically open PRs when new GoReleaser
releases are published.
<!-- CURSOR_AGENT_PR_BODY_END -->

Linear Issue:
[ENG-2676](https://linear.app/overmind/issue/ENG-2676/pin-goreleaser-version-in-terraform-provider-release-workflow)

<div><a
href="https://cursor.com/agents/bc-da41845f-eb32-4f09-8435-ee546f468e1c"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-web-light.png"><img
alt="Open in Web" width="114" height="28"
src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a>&nbsp;<a
href="https://cursor.com/background-agent?bcId=bc-da41845f-eb32-4f09-8435-ee546f468e1c"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img
alt="Open in Cursor" width="131" height="28"
src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a>&nbsp;</div>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: David Schmitt <DavidS-ovm@users.noreply.github.com>
GitOrigin-RevId: 3013c59e82ae4b1a67aa313be0a0ba6baaa3842e

Author: 2 people

.github/workflows/release.yml

@@ -52,7 +52,8 @@ jobs:
       - name: Run GoReleaser (publish)
         uses: goreleaser/goreleaser-action@v7
         with:
-          version: latest
+          # renovate: datasource=github-releases depName=goreleaser/goreleaser
+          version: "v2.14.3"
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

aws-source/module/provider/.github/workflows/release.yml

@@ -45,7 +45,8 @@ jobs:
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v7
         with:
-          version: latest
+          # renovate: datasource=github-releases depName=goreleaser/goreleaser
+          version: "v2.14.3"
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}