fix(ci): use tag reference for SLSA builder

The SLSA builder requires being invoked via a tag reference (e.g., @v2.0.0)
rather than a SHA. SHA pinning causes 'Invalid ref' errors.

Also fixes version comment - was incorrectly labeled as v2.1.0 when using
v2.0.0 SHA.

Author: CybotTM

.github/workflows/release-slsa.yml

@@ -75,7 +75,7 @@ jobs:
       id-token: write
       contents: write
       actions: read
-    uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@5a775b367a56d5bd118a224a811bba288150a563 # v2.1.0
+    uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v2.0.0
     with:
       go-version-file: go.mod
       config-file: .slsa-goreleaser/${{ matrix.target }}.yml