ci: add tag-module workflow

[c-julin]

Adds a workflow_dispatch workflow to bump and tag Go modules from the Actions UI.

• Supports specific modules (comma-separated) or all tagged modules
• patch / minor bump with dry run option
• Tested locally with act
• Written by claude but verified and tested behaviour is correct.

[secpanda]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[hidalgopl]

I'd suggest adding a guard against any version that contains rc/alpha/beta or anything like that to make it future proof:

version=${latest#"$mod/v"}
if ! [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
    echo "::error::Latest tag '$latest' is not a plain X.Y.Z version; refusing to auto-bump."                                                                                
    exit 1                                                                                   
  fi 

[hidalgopl]

I'd add:

concurrency:                                                                                                                                                               
    group: tag-module                                                                                                                                                        
    cancel-in-progress: false

to guard against running more than 1 of this workflow at the time, given that it pushes the tag(s).

cancel-in-progress is true by default, but I'd set it to false just to ensure this isn't canceled mid-run.