ci(release): label the action-gh-release pin as v3.0.3

The SHA dependabot pinned (efb35369) is upstream's v3.0.3 tag, a major bump
from the v2 line: 3.0.0 moves the action runtime from Node 20 to Node 24 and
changes nothing else. The pin comment still read v2, which would misdirect the
next reader of this file; label it with the version the SHA actually is.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

.github/workflows/release.yml

@@ -259,7 +259,7 @@ jobs:
           git tag -f "$VERSION" "$GITHUB_SHA"
           git push origin "$VERSION" --force
 
-      - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v2
+      - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           tag_name: ${{ inputs.version }}
           draft: true