Create the release-bot App, the v* tag ruleset and release-override #89

Goal

An organization-owned GitHub App is the only actor that may create api's v* tags, and can open bump pull requests in both services; release-override holds a release for approval.

Acceptance criteria

• The App is owned by metacensus and installed only on api, service-api-standard and service-api-chain, with Contents: Read and write, Pull requests: Read and write, and Metadata read-only.
• Its ID is api's repository variable RELEASE_BOT_APP_ID, and its private key api's repository secret RELEASE_BOT_PRIVATE_KEY; neither exists at organization level.
• A tag ruleset on api blocks creating, updating and deleting v* tags, with the App as its only bypass actor.
• api has an environment release-override with required reviewers.

Verification

git push origin "$(git rev-parse HEAD):refs/tags/v0.0.0-ruleset-probe"  # refused