Protect GHCR releases

[xopham]

Describe the feature
Releases to GHCR and gh-pages (documentation, Helm charts, artifacthub base) should be protected.

Optional: Is your feature request related to a problem? Please describe.
Rolling out automated build may expose artifacts to unauthorized users by overwriting the GitHub Actions in PRs and forging requests via the pipeline to delete/modify released artifacts (container images, documentation, Helm charts).

Optional: Implementation ideas
Several combined steps can help to mitigate the described risk:

• Configure CODEOWNERS
• Create an admin GitHub user ("alice") and a development GitHub user ("bob")
  • sole purpose is to provide credentials only scoped to Connaisseur with high and low privileges
  • this may be achievable via organizational settings
• Configure GitHub Environment for protected branches
  • Enable "Required Reviewers" to trusted contributors
  • Enable "Protected Branches only" scoped to required envs
  • Configure secrets (Cosign private & public keys, Cosign password, GitHub PATs for write & delete packages and push to GH pages)
• Setup 1 Environment for each develop and master scoped to bob and alice, respectively
  • release environment for master
  • development environment for develop
  • enforce "Required Reviewers" for release
• Protect gh-pages to exclusively allow pushes from alice (if possible, but may collide with dev docs)
• Configure Connaisseur package to restricted access
  • only "read" access by repository and contributors
  • "admin" only for alice
• Scope release and cicd workflows to environments
  • Set release environment for release
  • Make cicd a reusable workflow and call separately for develop and master branch with development and release environment, respectively
• Open up non-protected branches to allow development work via bob or even lower-privileged user with special access to connaisseur-test package
• Centrally restrict GITHUB_TOKEN (GH Actions)
• Make public cosign key configurable during workflow
• Rotate all static Secrets
• Publish official public Cosign key
• Make sse-secure-systems/connaisseur packages public
• Document layout in ADR
• Publish article on protection