Add a release workflow that builds and attaches binaries (#1515)

## Buildtools PR checklist

- [x] The code in this PR is covered by unit/integration tests.
- [x] I have tested these changes and provide testing instructions
below.
- [x] I have either responded to, or resolved all Gemini comments on the
PR.
- [x] I have read Google Eng Practices on [Small
Changes](https://google.github.io/eng-practices/review/developer/small-cls.html),
this PR either follows these guidelines or the description provides
reasoning for why they can not be followed.

## Description

Add a GitHub workflow that runs on a tag push, builds release binaries
and creates a release with the binaries attached. The workflow supports
immutable releases and creates attestations.