chore: use publish to bcr reusable workflow for bcr mirroring

[kormide]

Migrate rules_rust off of the deprecated Publish to BCR GitHub app to the newer reusable workflow. The reusable workflow has a number of benefits over the app:

• It supports build attestations which can be enabled at a later time.
• Gives finer grain control over running the publish process—if it fails, you can manually re-run the workflow.
• It's more secure—you control the PAT rather than giving the app write permissions.

Some actions that maintainer for this ruleset will need to take:

• Add a classic PAT named BCR_PUBLISH_TOKEN for the repository or org (see steps). As this is the bazelbuild org you'll want to decide whether to do this on a per-repo basis or have a single PAT for the org for all rulesets. You can use a bot token rather than a personal one like we do for Aspect publishes (example).
• Uninstall the GitHub app for this repo.
• Test a publish after landing, or wait for the next release. I'll be available to help debug any issues that come up if the workflow fails.

[kormide]

A fixed releaser is no longer required with the workflow because the identity of the publish token is now the actor who opens the PR on the BCR.

[kormide]

@UebelAndre @illicitonion

[UebelAndre]

@krasimirgg @scentini as Googlers, can you provide the access token?