docs: name the OpenVEX attestation on the site and unpin the override prose

A stranger's-path pass before the v1.25.19-1 announcement found two things on the documentation surfaces.

The site's "Verify the chain" section showed the SBOM and provenance commands and called them "both attestations". OpenVEX, the headline addition of this release, appeared nowhere in the site's prose, so a reader following "Full documentation" never verified it. The openvex command joins the block, with one sentence on what the document carries and a pointer to SECURITY.md for feeding it to a scanner.

SECURITY.md's override list named each module's target version. Those versions live in go-overrides.txt, where Renovate moves them, and the prose was already one bump behind (grpc v1.83.1 against v1.83.2 on main). The list now names only the advisory each override answers and points at the file for the version, which is what the paragraph beneath it already claimed.