feat: upload build artifacts as GitHub Release assets

[mwaldheim]

Summary

Allow specifying one or more local files (or glob patterns) to be uploaded as assets to the GitHub Release created by the provider.

Motivation

A typical release pipeline builds binaries, archives, checksums, or SBOMs and wants to attach them to the GitHub Release. Currently this requires a separate gh release upload step; first-class support in the provider plugin would simplify configuration significantly.

Proposed configuration

plugins:
  - name: provider-github
    path: ~/.semrel/plugins/semrel-plugin-provider-github
    env:
      SEMREL_PLUGIN_TOKEN: "${GITHUB_TOKEN}"
      SEMREL_PLUGIN_ASSETS: "dist/*.tar.gz,dist/checksums.txt,dist/*.sbom.json"

SEMREL_PLUGIN_ASSETS is a comma-separated list of file paths or glob patterns relative to the working directory.

Behaviour

• Each matched file is uploaded as a release asset using the GitHub Releases API
• If a glob matches zero files, the plugin logs a warning but does not fail
• Content-Type is inferred from the file extension; falls back to application/octet-stream
• Upload errors (e.g. duplicate asset name) surface as a plugin failure

Acceptance criteria

• SEMREL_PLUGIN_ASSETS accepted (comma-separated globs)
• Each matching file uploaded to the release
• Empty glob match → warning, not failure
• Content-Type inference for common types (.tar.gz, .zip, .json, .txt, .sig)
• Tests with a mock GitHub API server
• README updated with examples