Refresh vendored build tooling from upstream

[norman-abramovitz]

Refreshes the vendored mk/ tooling from upstream GNUMakefile-Snippets main (bump.mk, changelog.mk, go-release.mk, version.mk; help.mk and security.mk were already current). Three improvements arrive:

1. make publish resolves the tag that exists instead of deriving the next version — a bare tag-then-publish previously computed one release ahead and aborted on --verify-tag having published nothing (hit live releasing v1.24.1). The deletion verbs (untag/unpublish) now require an explicit TAG= rather than guessing.
2. make changelog-deps / changelog-deps-check — drafts release-notes fragments from dependency bumps landed since the last release, and reports when bumps aren't covered by any fragment. Relevant here now that Dependabot's action updates arrive as one grouped weekly PR.
3. v- tag-scheme support (for majors that outrun the module path) — inert in this repo: a v1 module keeps plain v tags.

Verified against this repo's real tags:

make check test-race changelog-check   # all pass
make tag DRYRUN=yes                    # derives v1.24.2 (next)
make publish DRYRUN=yes                # resolves v1.24.1 (existing), --notes-from-tag
make unpublish                         # errors: name the tag explicitly
make changelog-deps-check              # 0 dependency bump(s) in v1.24.1..HEAD
make bump dev DRYRUN=yes               # v1.24.1 -> v1.25.0-dev.1

Also carries the v1.24.1 fragment-sweep commit, riding along with the next PR as make changelog-sweep instructs.