chore: use publish to bcr reusable workflow for bcr mirroring

[kormide]

Migrate rules_rust off of the deprecated Publish to BCR GitHub app to the newer reusable workflow. The reusable workflow has a number of benefits over the app:

• It supports build attestations which can be enabled at a later time.
• Gives finer grain control over running the publish process—if it fails, you can manually re-run the workflow.
• It's more secure—you control the PAT rather than giving the app write permissions.

Some actions that maintainer for this ruleset will need to take:

• Add a classic PAT named BCR_PUBLISH_TOKEN for the repository or org (see steps). I recommend creating a "machine" user for bazelbuild and generating a classic PAT for that user rather than using an individual's PAT. For example, in bazel-contrib we use the bazel-contrib-bot user to do publishes.
• Uninstall the GitHub app for this repo.
• Test a publish after landing, or wait for the next release. I'll be available to help debug any issues that come up if the workflow fails.

[kormide]

A fixed releaser is no longer required with the workflow because the identity of the publish token is now the actor who opens the PR on the BCR.

[kormide]

@UebelAndre @illicitonion

[UebelAndre]

@krasimirgg @scentini as Googlers, can you provide the access token?

[kormide]

Updated the instructions in the PR description to recommend creating a machine user for bazelbuild and using that user to generate a classic PAT. We do this for bazel-contrib and aspect-build and have associated bot users like https://github.com/bazel-contrib-bot.