Return full URLs instead of raw filenames for added/removed Trusted Publisher sources/workflows

[nlhkabu]

Refs discussion on #20326 (Release.provenance_status): #20326 (comment)

Describe the solution you'd like

1. Update the provenance-status API/data shape so that removed sources and removed workflows are each self-describing (carrying their own platform/kind), and expose the equivalent of viewer.source and viewer.workflow_url instead of a bare removed_workflows list of filenames.

2. At the same time implement handling for changes to publisher.email on Google publisher types (@di responded "Yes!" to this being needed, but no implementation was linked in the thread).

3. Update templates to consume changes

[nlhkabu]

Opening this as a separate issue so we can unblock merging of #20408