Setup rubygems trusted publisher workflow for core component gems

[cjcolvar]

Based on Github processes and permissions WG proposal:

Core Components in rubygems will have owners removed except for a Samvera service rubygems account. A gem publishing github action will be setup using rubygem's "trusted publisher" feature. This workflow will be triggered when version tags are pushed and will require the approval within github of one of the tech leads (as part of a core publishing team) or users added by the tech lead to a publishing github team specific to that gem.

• Notify tech call
• Notify tech email discussion list
• Notify users losing owner role
• Make changes based upon proposal

[cjcolvar]

Feedback from tech call was to put this workflow in place for one gem and see how it goes for a couple releases before spending the effort to roll it out to all of the core components.

[cjcolvar]

Tracking wiki page: https://samvera.atlassian.net/wiki/spaces/samvera/pages/3593601025/Proposal+for+Changes+to+Github+and+Rubygems+Permissions