ci: replace semantic-release with tag-triggered manual release

[BeiBaiNian]

Summary

Repositories should no longer auto-publish new versions to GitHub Releases and
package registries. New releases must be voted on by the community first, so
releases are now cut manually by pushing a git tag.

Changes in this PR:

• remove .releaserc.json (semantic-release config)
• remove the semantic-release job from .github/workflows/ci.yml, which ran
  semantic-release on every push to auto-publish
• add .github/workflows/release.yml - a manual, tag-triggered release workflow:
  • vX.Y.Z-rcN -> GitHub pre-release with the source tarball (for the
    Apache release vote)
  • vX.Y.Z -> GitHub release with the source tarball (the Go module is
    then picked up automatically by proxy.golang.org)
  • assets: casbin-mongodb-adapter-<version>-incubating-src.tar.gz + .sha512
  • the release manager downloads the tarball and signs it locally; this
    workflow does not sign anything and does not touch other Apache
    infrastructure
• add DISCLAIMER and NOTICE (Apache incubation compliance)

No Go source code or go.mod is changed; the test pipeline is kept unchanged.

Verification

• both workflow YAMLs parse successfully
• tag parsing logic verified locally: v1.4.0-rc1 -> pre-release, v1.4.0 ->
  release, invalid tags -> workflow fails
• source tarball and SHA-512 checksum generated and verified locally
  (git archive + sha512sum)
• the full test matrix is to be confirmed by GitHub Actions on this PR