chore: revisit publishing process

[jkowalleck]

• incorporate full branch protection
  • use own app for push to origin branch ala chore(release): use own GH app for releasing cyclonedx-python-lib#958
  • require ALL pushes to go through a merge request
• split tests, build, publish ...
• to be continued