fix(ci): replace GITHUB_TOKEN by fine-grained one

[cjdcordeiro]

• Have you signed the CLA?

---

After the recent changes to the GITHUB_TOKEN, the build.yml workflow can no longer push the release artifacts to the GitHub release: https://github.com/canonical/chisel/actions/runs/24026969346

This PR replaces the GITHUB_TOKEN with a new one, managed by us. This new token has contents: write permissions (similarly to the GITHUB_TOKEN), which are unfortunately broad, because GitHub does not offer fine-grained control for releases. The use of the secret is bound to a single step, which runs our own CI script, and always in the context of the base repo and on release events.

[upils]

Thanks @cjdcordeiro. I was a bit worried because this workflow is executed in PRs, but this step is only executed for releases and the secret is only loaded for this specific step so I understand this is fine.

I see that we now have a growing collection of fine-grained tokens and it makes me wonder how much of a burden that will be to maintain. Maybe we should revisit at some point and use the permissions keyword at steps/jobs level to give a bit more permissions to the GITHUB_TOKEN when needed.