feat(aft): CI mode for publish command

[cadivus]

This enables us to automatically push new package versions to pub.dev after a version bump. Because of the requirements by https://dart.dev/tools/pub/automated-publishing#configuring-a-github-action-workflow-for-publishing-to-pub-dev, we need to create a new tag for each bumped package that triggers its own workflow. In order to be able to do this, we introduce a Github app that has the needed permissions.

The --ci mode of aft publish will push tags instead of running dart pub publish. Everything else stays the same and has already proven its functionality. The release-tag workflows runs a few checks to make sure the tag matches the package version.
The version bump is triggered with another workflow that has also shown its functionality a few times - it stays untouched. Since version bumping is its own PR, releases are triggered intentionally.

Tested in a private repo by mocking a few things.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 40.97%. Comparing base (087ff5d) to head (006d90b).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7256   +/-   ##
=======================================
  Coverage   40.97%   40.97%           
=======================================
  Files         121      121           
  Lines        8273     8273           
  Branches     3598     3598           
=======================================
  Hits         3390     3390           
  Misses       4883     4883           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.