[aguspe]

The 3.10.0 release run (40972439351) failed at its first step. actions/create-github-app-token could not read the APP_PRIVATE_KEY secret (Invalid keyData), so nothing was published.

This PR changes the Release workflow:

• Drops the GitHub App token. The create-github-app-token step and the token: input on checkout are removed, so checkout, the GitHub release and the tag all use the built-in GITHUB_TOKEN. The job keeps contents: write and id-token: write, the second for RubyGems trusted publishing.
• No more version-bump push. master is protected, so the workflow no longer pushes a version-bump commit to it. A new "Check version file" step fails with a clear error when lib/version doesn't match the requested version. The release process is now:
  1. Bump lib/version in a PR.
  2. Merge the PR.
  3. Run the Release workflow with that version.
• Removes the "Configure git" step. It was only used for the bump commit.
• Unchanged: the GitHub release guard and the RubyGems guard, plus the trusted-publishing push from Failure video replay and parity cleanup (3.10.0) #163.

master already has lib/version = 3.10.0, so once this merges, 3.10.0 can be released by running the workflow again.

APP_ID, APP_PRIVATE_KEY and RUBY_GEMS_API_KEY are no longer used by this workflow and can be removed once a release has worked.