Draft releases require write-level access to be visible via the GitHub
API. The validate-release job had only contents:read, causing
`gh release view` to fail with "No release found" for draft releases.
Uses a release workflow with environment protection for publishing
releases instead of relying on user invocation.
The `release` environment can then be protected, e.g., requiring
approval from another team member. We can add a tag ruleset to prevent
tags from being created outside of the `release` environment.
I've never used Release drafter, but the workflow here differs from our
other projects in that the release process just marks the draft release
as final and adds the tag. The draft release is required, for
simplicity.
