refactor: extract create-provenance to a script

[keerthi-go]

Summary

Moves the 73-line Create provenance file inline shell block out of qcom-release-reusable-workflow.yml into scripts/create-provenance.sh.

The workflow step becomes a single line:

- name: Create provenance file
  env:
    DISTRO_CODENAME: ${{ inputs.suite }}
    DEBIAN_BRANCH: ${{ inputs.debian-branch }}
    UPSTREAM_REPO: ${{ vars.UPSTREAM_REPO_GITHUB_NAME }}
    PKG_VERSION: ${{ steps.changelog.outputs.version }}
    PKG_REPO: ${{ github.repository }}
  run: ./qcom-build-utils/scripts/create-provenance.sh

No behaviour change

All logic is identical — supports both source packages and prebuilt binary packages (upstream.conf). All env vars are unchanged. Script validates required vars at startup with :${VAR:?}.

[keerthi-go]

Superseded by #165 which combines both provenance scripts into one PR.