fix(ci): add release-assets.githubusercontent.com to egress allowlist (#362)

GitHub Releases downloads redirect to release-assets.githubusercontent.com,
not objects.githubusercontent.com. Add the correct domain to harden-runner
allowed-endpoints so Trivy binary download succeeds.

🖥️ IDE: [Cursor](https://cursor.sh)
🔌 Extension: [Claude Code](https://claude.ai/download)


Model-Raw: claude-opus-4-6-20250514

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: nullvariant

.github/workflows/publish.yml

@@ -32,6 +32,7 @@ jobs:
             marketplace.visualstudio.com:443
             oauth2.sigstore.dev:443
             objects.githubusercontent.com:443
+            release-assets.githubusercontent.com:443
             open-vsx.org:443
             pkg-containers.githubusercontent.com:443
             registry.npmjs.org:443