Add OIDC-based buildpack release workflow (#2099)

Calls the shared `_classic-buildpack-publish.yml` workflow from
`heroku/languages-github-actions` to publish the `heroku/python`
buildpack to the registry via OIDC.

Auto-triggers when the Linguist-authored "Prepare release" PR is
merged to `main` (guarded on event, branch, repo, and PR author).
Also supports manual `workflow_dispatch`.

Mirrors the pattern established in heroku/heroku-buildpack-nodejs#1653.

GUS-W-22295409 is the reference implementation; this is the python
caller workflow for the OIDC-Based Classic Buildpack Publishing epic.

GUS-W-22295419.

Author: colincasey

.github/workflows/release.yml

@@ -0,0 +1,31 @@
+name: Release Buildpack
+
+on:
+  # Auto-trigger when the "Prepare release" PR (created by the
+  # _classic-buildpack-prepare-release.yml workflow) is merged.
+  pull_request:
+    branches:
+      - main
+    types:
+      - closed
+  workflow_dispatch:
+
+permissions:
+  id-token: write
+  contents: write
+
+jobs:
+  release:
+    name: Release
+    # On `pull_request`, only run for the merged auto-generated
+    # "Prepare release" PR (branch name set by
+    # _classic-buildpack-prepare-release.yml). Manual dispatches always run.
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.pull_request.merged == true &&
+       github.event.pull_request.head.repo.full_name == github.repository &&
+       github.event.pull_request.head.ref == 'prepare-release' &&
+       github.event.pull_request.user.login == 'heroku-linguist[bot]')
+    uses: heroku/languages-github-actions/.github/workflows/_classic-buildpack-publish.yml@latest
+    with:
+      buildpack_id: "heroku/python"