Switch to GR's tagging workflow

[Smaug123]

Observe the output of the dry-run stage:

Run G-Research/common-actions/github-release@19d7281a0f9f83e13c78f99a610dbc80fc59ba3b
Run $GITHUB_ACTION_PATH/github-release.sh
cURL body: {"tag_name":"ApiSurface.4.1.16-ga60aa23b89","target_commitish":"a60aa23b897f419fa2d53a9a2855bc62a2295399","name":"ApiSurface.4.1.16-ga60aa23b89","draft":false,"prerelease": false,"generate_release_notes":false}
Creating release with curl: https://api.github.com/repos/G-Research/ApiSurface/releases
Posting binary contents of ApiSurface.4.1.16-ga60aa23b89.nupkg to https://uploads.github.com/repos/G-Research/ApiSurface/releases//assets?name=ApiSurface.4.1.16-ga60aa23b89.nupkg

(notice the usual weirdness of the final URL, because we don't have a release number because this is a dry-run, so we get releases//assets rather than releases/<id>/assets. I should make that clearer at some point.)

@jgiannuzzi Do you remember why there was an app ID here - is it the case that we don't have release permissions by default or something like that?

[jgiannuzzi]

@Smaug123 the app ID is necessary to get an app token that allows the workflow to create a tag. All tags are protected and only the app is allowed to create new ones. The app ID and private key are stored as secrets in an environment named release that can only be used by workflows running on the main branch. See https://github.com/G-Research/ApiSurface/rules for the rulesets used to protect the branches and tags. The rest is unfortunately hidden behind admin perms.