Run the release job in a protected GitHub environment, and bind the trusted publishers to it #465

From the review of #463 (#463 (comment)).

Problem

release-plz.yml publishes to crates.io through trusted publishing with id-token: write granted to the whole workflow and no environment: on any job. crates.io's trusted publisher for GitHub checks the repository and the workflow file name, and, optionally, an environment. Without one, it does not check the branch: anyone with write access can push a branch whose release-plz.yml runs on that branch, and that run gets an OIDC token crates.io accepts for every crate that trusts the workflow. Every crate already on trusted publishing has this gap today, and the three crates 0.6.0 adds (vitaminc-aead-frame, vitaminc-normalize, vitaminc-ore) will join it when they are set up.

Fix

1. Create a release environment in the repository settings with a deployment branch rule that allows only main.

2. Put the release-plz-release job in it:

     release-plz-release:
       name: "Release"
       runs-on: ubuntu-latest
       environment: release

3. On crates.io, set the environment to release on every crate's trusted publisher, and say so in RELEASING.md under "A crate's first release", step 3.

Do step 1 before step 2 merges, or the environment is created on first use with no protection rule.

Out of scope

RELEASE_PLZ_APP_PRIVATE_KEY is a repository secret, available to any workflow in the repository. Moving it into the environment protects it the same way, but the release-pr job needs it too, so that job would also move into the environment; it only runs on main, so the rule would not block it. Decide separately.