docs: say the override moves the pinned module's requirements too

go-overrides.txt pins golang.org/x/crypto at v0.56.0, and each builder stage applies it with go get, go mod tidy and go mod vendor. Go's minimum version selection then raises that module's own requirements too, not only the one this repository names.

Measured with go version -m on the built executor, before (upstream v1.25.19's go.mod) and after (with the override): golang.org/x/net v0.56.0 to v0.57.0, golang.org/x/sync v0.21.0 to v0.22.0, golang.org/x/sys v0.46.0 to v0.47.0, golang.org/x/text v0.39.0 to v0.41.0.

The io.gitlab.public-sector.kaniko.go_overrides label only names what we pinned, so a reader could think one module changed when five did. SECURITY.md's "Go module overrides" section now says so directly, and points to the SBOM attestation and go version -m on the extracted executor for the complete list. CHANGELOG gets one line under ## [Unreleased] / ### Changed.

README doesn't describe the label, so it is untouched.

Docs only: no Dockerfile, go-overrides.txt, scripts/, or .gitlab-ci.yml change, so .release-only-rules' changes: gate should skip the six image-touching jobs. Expect the standard non-image pipeline only.