Replace softprops/action-gh-release with gh CLI

[Copilot]

GitHub Advanced Security flagged softprops/action-gh-release as unnecessary since gh CLI is pre-installed on GitHub-hosted runners and provides the same release upload functionality natively.

Changes

• action.yml: Replaces the softprops/action-gh-release action step with a run step using gh release upload
  • Authenticates via GH_TOKEN: ${{ github.token }}
  • Parses the newline-separated GHA_SIGSTORE_PYTHON_INTERNAL_SIGNING_ARTIFACTS env var, filters empty lines, and uploads all artifacts in a single command

- name: Upload signing artifacts to release
  if: inputs.release-signing-artifacts == 'true' && github.event_name == 'release' && github.event.action == 'published'
  shell: bash
  env:
    GH_TOKEN: "${{ github.token }}"
  run: |
    readarray -t artifacts < <(echo "$GHA_SIGSTORE_PYTHON_INTERNAL_SIGNING_ARTIFACTS" | grep -v '^$')
    [[ ${#artifacts[@]} -gt 0 ]] && gh release upload "$GITHUB_REF_NAME" "${artifacts[@]}"

---

📱 Kick off Copilot coding agent tasks wherever you are with GitHub Mobile, available on iOS and Android.