[36.0.x] Use github immutable releases (#11916)

* Attempt to use github immutable releases (#11902)

[Immutable Releases] look to be a relatively new feature on github which
is a natural fit for us where we have no need to modify release assets
after creation. My failed attempt to enable this earlier turned out to,
expectedly, not work. This commit is an attempt to make things work.
Specifically releases are now created as a draft initially, then release
assets are attached, and finally it's automatically marked as a
non-draft. While one could make a reasonable argument that a human
should be involved in making the release a non-draft there's also
something nice about just hitting merge on a PR and letting the release
ride through CI.

[Immutable Releases]: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases

* Fix release script (#11906)

This is an attempt to fix a bug with #11901 where for 38.0.2 a draft
release was made but it wasn't published due to a bug, so hopefully
it'll be less buggy next time.

Author: alexcrichton

.github/actions/github-release/main.js

@@ -99,6 +99,7 @@ async function runOnce() {
       repo,
       tag_name: name,
       prerelease: name === 'dev',
+      draft: name !== 'dev',
     };
     if (name !== 'dev') {
       for (let x of releaseNotes.split(/^---+$/m)) {
@@ -140,6 +141,15 @@ async function runOnce() {
       url: release.data.upload_url,
     });
   }
+
+  if (name !== 'dev') {
+    octokit.rest.repos.updateRelease({
+        owner,
+        repo,
+        release_id: release.data.id,
+        draft: false,
+    });
+  }
 }
 
 async function run() {