2.5.0 - extra_sbom_jobs array on release-create

release-create now accepts an `extra_sbom_jobs:` type-array input
backing a new `upload-extra-sbom-assets` job, so consumers shipping
N SBOMs per release can link all of them to the GitLab Release page.

Backward compat: omitting `extra_sbom_jobs` keeps the prior single-
SBOM behavior; the new job runs tag-only as a cheap no-op when the
input is defaulted.

GitLab CI components only support whole-value array substitution,
so the multi-SBOM path lives in a second job rather than expanding
the existing upload-release-assets needs: block.