bake: reject targets inside target blocks

[amarkdotdev]

Summary

• reject the attribute when it is used inside a block
• point users toward blocks for grouped bake targets
• add a regression test for issue Invalid bake target syntax still builds #2437

Testing

• go test ./bake -count=1

Closes #2437

[amarkdotdev]

Gentle ping on this one. It's a small, self-contained fix for #2437: bake now rejects a targets attribute used inside a target block (it belongs in a group block) with a clear "Unsupported argument" diagnostic, instead of silently building. DCO and labeler are green, and go test ./bake -count=1 passes locally (full package suite, including the new TestTargetDisallowsGroupTargetsAttribute).

The build / validate / e2e / codeql workflows are sitting in the "action required" state pending a maintainer's approval to run on this PR. Could a maintainer approve the run and take a look? Happy to address anything that comes up. Closes #2437.