Release without Grafana's catalog validator; run CI on main

[ngc7293]

The v2.0.0 release failed in grafana/plugin-actions/build-plugin. That action runs Grafana's catalog-submission validator (@grafana/plugin-validator@latest) as a hard gate, and it reported three errors:

• "organization not found": the catalog requires the plugin ID's prefix (transitapp) to be a registered Grafana Cloud account.
• Relative links in the README, which the catalog cannot resolve.
• High-severity advisories in package-lock.json for basic-ftp and braces.

This plugin is installed directly, not published to the catalog, so the release workflow now builds, tests and packages it itself and publishes a GitHub release with the zip, its sha1, and the latest CHANGELOG section as notes. It checks that the tag matches package.json's version. Two other reasons to drop the action: braces has no fixed release (every version through 3.0.3, the latest, is affected), so the scanner would block every release regardless; and the action pulls its packaging step from @main and the validator from @latest, so the rules a release must pass change without notice. Grafana's plugin.json check still runs in CI. If the plugin ever goes to the catalog, switch back to build-plugin.

Also fixed:

• basic-ftp: overridden to ^6.2.2. Nothing upstream offers a fixed version; even the latest get-uri, via @grafana/sign-plugin's proxy support, wants 5.x. 6.0's only breaking change disables separate FTP transfer hosts, which get-uri does not use. braces is dev-only (jest, eslint-webpack-plugin) and not in the bundle.
• README links are absolute, and the screenshot and licence URLs point at main; they pointed at master, which does not exist here, and returned 404.
• CI and CodeQL only ran on master, so they never ran on this repo, including on the PR that merged the modernisation. They now run on main, and CodeQL moves to its current major, v4.
• The release uses the Node version in .nvmrc (22); the action defaulted to 20.

The README gains an Installation section with the Helm values, and CONTRIBUTING describes the new release steps.