chore: align project metadata with Apache Reqsign

[tisonkun]

Reqsign is now a top-level ASF project, but project branding, notification routing, security contacts, and release instructions still identify it as OpenDAL Reqsign. Update these references following the migration announcement and the ASF committee registry.

• Use Apache Reqsign in the READMEs, shared NOTICE, repository description, maintainer guidance, security documents, and generated crate reservations. Correct the obsolete subproject description while preserving OpenDAL integration boundaries.
• Route commit, issue, and pull-request notifications to commits@reqsign.apache.org. Route Discussions and their mailing-list thread lookup to dev@reqsign.apache.org, add subscription/archive links, and send vulnerability reports to private@reqsign.apache.org.
• Update release names, community/PMC references, dist paths, and KEYS URLs to Reqsign. Require dist and KEYS provisioning before the first independent release and retain a link to historical OpenDAL releases.
• Accept the exact historical placeholder description during bootstrap audits so previously published reservations can still resume without republishing. New reservations use the current name. Extend the existing recovery test to cover both descriptions using the shared constants.

The new website and Reqsign dist roots returned HTTP 404 during verification. Keep the working docs.rs homepage and document the dist/KEYS prerequisite under INFRA-28423. Existing cloud test resource identifiers and immutable published repository metadata remain valid and are preserved.

Validation:

• Release helper unit tests: 33 passed, including recovery of placeholders published under the former project name.
• hawkeye check and git diff --check passed after the review fixes; cargo fmt --all -- --check passed for the initial changes, with no subsequent Rust edits.
• cargo metadata --no-deps verified the canonical repository URL and updated shared NOTICE for all 15 workspace crates.
• Parsed the ASF and Discussion workflow YAML and checked the embedded JavaScript syntax with Node.

No Rust implementation changes; live notification delivery and dist provisioning are not exercised by local checks.

[tisonkun]

Why not reuse LEGACY_PLACEHOLDER_DESCRIPTION?

[tisonkun]

Suggested change

	commits: dev@reqsign.apache.org
	issues: dev@reqsign.apache.org
	pullrequests: dev@reqsign.apache.org
	commits: commits@reqsign.apache.org
	issues: commits@reqsign.apache.org
	pullrequests: commits@reqsign.apache.org

[tisonkun]

Suggested change

	Apache Reqsign is an independent Apache top-level project. OpenDAL remains the
	Apache Reqsign is a top-level ASF project. OpenDAL remains the