Migrate to centrally-managed actions

[Smaug123]

1. Bugfix: the all-required-checks-complete action now genuinely does require all checks to succeed (previously it did not).
2. Feature: we now perform GitHub attestation on the resulting NuGet package. I'll test this once the new version gets released, with gh attestation verify --owner G-Research ~/.nuget/packages/apisurface/{newversion}/apisurface.{newversion}.nupkg.

See https://github.com/G-Research/common-actions

I've tested both these actions under a variety of conditions on my own repos; see, for example, the all-checks-complete and the publish actions.