✨ cicd: bump the version before tagging so releases report their own version (#365)

* ✨ cicd: bump the version before tagging instead of after

The version reported to the Crowdsec LAPI lives in version.go, so it must
be correct in the very commit the tag points at. Every mechanism so far
updated it *after* the tag existed, which cannot work:

- release.yml ran on `release: published` and force-moved the tag. It also
  failed on all four of its runs and was removed in #360.
- The Renovate customManager on version.go uses the github-tags datasource,
  so it can only propose vX once vX is already tagged. The bump always lands
  after the tag.

Result: v1.7.0 is tagged at a commit reading v1.6.0 (#363), same shape as
the earlier #322.

Replace both with a two-step flow that bumps first and tags last, so the
released source always matches its tag.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* 🍱 reduce loc + remove claude code comment

* 🍱 remove useless spellcheck disable

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: maxlerebourg <maxlerebourg@gmail.com>

renovate.json

@@ -25,16 +25,6 @@
     }
   ],
   "customManagers": [
-    {
-      "description": "Plugin self-pin in version.go (pluginVersion)",
-      "customType": "regex",
-      "managerFilePatterns": ["/^version\\.go$/"],
-      "matchStrings": [
-        "pluginVersion\\s*=\\s*\"(?<currentValue>v[0-9]+\\.[0-9]+\\.[0-9]+)\""
-      ],
-      "depNameTemplate": "maxlerebourg/crowdsec-bouncer-traefik-plugin",
-      "datasourceTemplate": "github-tags"
-    },
     {
       "description": "Plugin self-pin in docker-compose CLI args (--experimental.plugins.bouncer.version=vX)",
       "customType": "regex",