Deprecate bare `:snapshot` and flip `:latest` to v5 at v4 EOL

[nscuro]

This issue runs around 6 months post-GA, when v4 EOL is announced. The apiserver and frontend EOL flips are interlocked.

Step order is critical. The workflow edits on 4.14.x must happen before the branch goes read-only. Otherwise the
deprecation can never be merged.

For each of dependency-track:4.14.x and frontend:4.14.x, in this order, run the five steps below.

1. Edit _meta-build.yaml on 4.14.x

Stop publishing bare :snapshot from this branch. Optionally retag the last v4 nightly as :4-snapshot-eol for forensic
pulls. The :4-snapshot tag (from the caller-side major-version derivation, when it was carried over to the v4 branch)
continues to exist as the frozen v4 nightly. Bare :snapshot is removed from the tag set entirely.

2. Cut the final 4.14.z patch (if any)

This locks in the EOL state for v4 consumers who pin a specific version.

3. Mark 4.14.x read-only

Branch protection: no pushes, no merges, no force-pushes. Document publicly that v4 maintenance has ended.

4. Revert the major == 5 :latest guard on dependency-track:main

_meta-build.yaml returns to its pre-cutover :latest behavior. v5 takes over :latest on the next v5 GA-train release
after this revert. Apply the same revert on frontend:main.

5. Public EOL announcement

Cover both flips:

• :latest is now v5.
• Bare :snapshot is deprecated. Consumers must migrate to :4-snapshot (frozen) or :5-snapshot (advancing) explicitly.

The "deprecate, not flip" choice on :snapshot is deliberate. Silently moving long-time v4 nightly consumers across a
major version on the next pull is the kind of churn this whole cutover is designed to avoid. Forcing an explicit decision
per consumer is the price of avoiding it.