check_latest_tag_in_changelog : play nice with release-it

The check_latest_tag_in_changelog job doesn't like the CHANGELOGs generated by our release-it template. See, for example, https://gitlab.developers.cam.ac.uk/uis/devops/infra/terraform/gcp-secret-manager/-/jobs/1278411. I've worked around this for the moment in uis/devops/infra/terraform/gcp-secret-manager!13 (merged) by disabling the check_latest_tag_in_changelog job but this issue tracks teaching it about the changelog format.