ci: Publish binaries and Docker images on release

[mangas]

Stacked on #6734 (release-please). When release-please cuts a release, this publishes binaries and Docker images. It also replaces the Google Cloud Build setup.

Binaries (.github/workflows/publish.yml): builds graph-node for x86_64 and aarch64 Linux, cross-compiling the latter, and attaches the gzipped binaries and a SHA256SUMS file to the release.

• It can be run by hand with tag_name and dry_run. A dry run uploads the bundle as a workflow artifact and leaves the release untouched.
• It uses GITHUB_TOKEN only.

Docker images (.github/workflows/docker.yml): builds the graph-node and graph-node-debug targets of docker/Dockerfile for linux/amd64, with the same build args and tags as docker/tag.sh:

Build	Tags
every build	7-char short SHA
push to master	nightly
release (called from release.yml)	vX.Y.Z, latest

• Images always go to ghcr.io/graphprotocol/graph-node and ghcr.io/graphprotocol/graph-node-debug.
• If DOCKERHUB_USERNAME and DOCKERHUB_TOKEN are set, the same tags also go to Docker Hub graphprotocol/graph-node(-debug). Without the token, the "Log in to Docker Hub" step shows as skipped and the images go to ghcr only. Tags come from docker/metadata-action.
• docker-compose.yml and docker/README.md keep the Docker Hub name.

Removed: docker/cloudbuild.yaml and docker/tag.sh. Cloud Build is still pushing to Docker Hub today, so its trigger should be disabled when this merges.

Before this leaves draft:

1. Add DOCKERHUB_USERNAME and DOCKERHUB_TOKEN as repository secrets, for an account with push access to graphprotocol/*. Cloud Build pushed as lutter.
2. After the first push, set the two ghcr packages to public. If they already exist in the org, give this repo write access to them.
3. Nothing here has run on a real runner yet. The first test can be publish.yml by hand with dry_run: true, plus docker.yml by hand from this branch, which pushes only short-SHA tags.

Known and left as is:

• A release commit is built twice, once from the master push (nightly) and once from the release (vX.Y.Z, latest); Cloud Build did the same.
• nightly has no concurrency guard, so two master pushes close together can finish out of order.