feat: include packages in release evidence

What does this MR do and why?

This MR implements the first step of linking packages to release evidence. When release evidence is collected, it now automatically includes any packages from the project's package registry that match the release tag.

For example, if a release is created with a tag v1.0.0, any packages in the project with version 1.0.0 will be included in the release evidence JSON.

This removes the need to manually associate packages with releases via the Release Links API, making the release-to-package connection automatic.

Related to: #283995 (closed)

How it works

• A new Release#associated_packages method queries for displayable packages whose version matches the release tag (stripping the v prefix if present, e.g. v1.0.0 → 1.0.0).
• A new Evidences::PackageEntity serializer exposes package metadata (id, name, version, package_type, created_at).
• The Evidences::ReleaseEntity now includes a packages field alongside the existing milestones and project fields.
• No database migrations are required — matching is done via query at evidence creation time.

MR acceptance checklist

• Unit tests forEvidences::PackageEntity
  • Unit tests forRelease#associated_packages(version matching,vprefix stripping, blank tags, non-displayable package exclusion)
  • Integration tests forReleases::CreateEvidenceService(packages in evidence summary)
  • JSON schema updated for evidence validation
  • Consider UI changes to surface packages on the release page (follow-up)
  • Consider API changes to expose packages in the Releases API (follow-up)

Query Plan

SELECT "packages_packages".*
FROM "packages_packages"
WHERE "packages_packages"."project_id" = XXX
  AND "packages_packages"."status" IN (0,
                                       3,
                                       5)
  AND "packages_packages"."version" = 'XXX';

https://console.postgres.ai/gitlab/gitlab-production-main/sessions/50065/commands/148678

---