Create GitHub release after publication

[DanielThomas]

Summary

• create a GitHub release after the Maven Central publication job succeeds
• generate release notes from the pushed version tag
• mark release-candidate tags as prereleases
• grant write access to repository contents only to the GitHub release job

Test plan

• matched the job to the release automation in Netflix/ja
• ran git diff --check