docs: add GitHub App setup guide for release automation

[posquit0]

👋 Background

We are piloting release-please on terraform-aws-account before rolling it out through this repository's reusable workflows. Release pull requests and tags created with GITHUB_TOKEN do not trigger other workflows, so CI would not run on release pull requests. We use an organization-owned GitHub App instead of a personal access token.

What changed

• Add docs/release-github-app.md, which covers:
  • why a GitHub App instead of GITHUB_TOKEN or a personal access token
  • the App settings and the minimal repository permissions (Contents, Pull requests and Issues as read and write, Metadata as read-only, no webhook, installed only on selected repositories)
  • the organization secrets RELEASE_GITHUB_APP_CLIENT_ID and RELEASE_GITHUB_APP_PRIVATE_KEY, and how to set them with gh secret set
  • a workflow snippet that uses the github.release-please action (feat(github.release-please): add the composite action for release-please with a GitHub App token #40), which mints a short-lived token with actions/create-github-app-token@v3 (client-id) narrowed to the three write permissions
  • key rotation and revocation
• Add scripts/set-release-github-app-secrets.sh for the GitHub Free plan, where private repositories cannot use organization secrets. It sets RELEASE_GITHUB_APP_CLIENT_ID and RELEASE_GITHUB_APP_PRIVATE_KEY as repository secrets in every non-archived terraform-* repository with the type-module topic (or the repositories given as arguments), and deletes the legacy RELEASE_GITHUB_APP_ID secret where it exists. The values come from environment variables and are passed to gh secret set through standard input, never as arguments. It supports --dry-run and reports the repositories where it failed.

Notes

• The permission set follows the workflow permissions documented by release-please-action (contents, issues, pull-requests: write).
• No secret values are included. The App and secrets still need to be created by an organization admin.
• The guide stores the App's Client ID (it starts with Iv) as RELEASE_GITHUB_APP_CLIENT_ID. Workflows pass it to the github_app_client_id input of github.release-please, which passes it as client-id. client-id replaces the deprecated app-id in create-github-app-token v3. GitHub recommends the Client ID as the JWT issuer. The script rejects a numeric App ID so that the value matches the secret name. Workflows that follow the guide pass lint now that feat(github-actions.actionlint): lint with jactionlint #37 (switch to jactionlint) is merged.

[github-actions]

👋 Welcome! Looks like this is your first pull request.

Hey, thanks for your contribution! Please give us a bit of time to review it. 😄

Please check out our contributing guidelines.