Modernize CI and release pipelines

[andystaples]

Summary

Remove stale GitHub workflows and tighten the remaining CI/release configuration.

Changes

• Remove .github/workflows/publish-release.yml.
  • It was a legacy tag-triggered publisher for GitHub Packages, not the official release path.
  • Official signed packages are built and published through the Azure DevOps/1ES pipelines.
  • The GitHub workflow has failed on every recent release and no longer provides a reliable release artifact.
• Remove .github/workflows/codeQL.yml.
  • The checked-in workflow was broken because it referenced a nonexistent reusable build.yml workflow and expected an artifact that was never produced.
  • GitHub CodeQL default setup is already active for this repository; its last ten observed scans succeeded.
  • Default-only CodeQL is also used successfully by microsoft/durabletask-go and microsoft/durabletask-java, avoiding duplicate analysis while preserving code-scanning coverage.
• Harden .github/workflows/build-and-test.yml.
  • Restrict GITHUB_TOKEN to read-only repository contents.
  • Pin actions/checkout and actions/setup-dotnet to immutable commit SHAs.
  • Remove the unused placeholder NUGET_AUTH_TOKEN.
• Correct eng/ci/publish.yml release ordering.
  • Require every NuGet.org publishing job to wait for both manual approval and successful publication to the internal ADO feed.
  • Remove the obsolete durabletask_config variable group, since publishing now uses the configured DurableTask org NuGet API Key service connection.

Validation

• Built the solution in Release configuration successfully.
• Parsed all remaining GitHub Actions and Azure DevOps YAML files.
• Reviewed the final diff for release-ordering, permission, and security regressions.