The new EU tech sovereignty package shows a welcome shift from defensive regulation