workflows: add release promotion job

[patrick-stephens]

Now we have a staging build & test workflow we need to complete the final stage of the release pipeline with a manual job to promote to release.

This should push to the DockerHub repo all the images currently staged - no rebuild.
This should push the staging bucket contents to a release bucket and the existing server - plus sign with the release GPG key.