chore: use publish to bcr reusable workflow for bcr mirroring (#3775)

Migrate rules_rust off of the deprecated Publish to BCR GitHub app to
the newer reusable workflow. The reusable workflow has a number of
benefits over the app:
* It supports build attestations which can be enabled at a later time.
* Gives finer grain control over running the publish process—if it
fails, you can manually re-run the workflow.
* It's more secure—you control the PAT rather than giving the app write
permissions.

Some actions that maintainer for this ruleset will need to take:
* [x] Add a classic PAT named `BCR_PUBLISH_TOKEN` for the repository or
org (see
[steps](https://github.com/bazel-contrib/publish-to-bcr?tab=readme-ov-file#setup)).
I recommend creating a "machine" user for bazelbuild and generating a
classic PAT for that user rather than using an individual's PAT. For
example, in bazel-contrib we use the
[bazel-contrib-bot](https://github.com/bazel-contrib-bot) user to do
publishes.
* [ ] Uninstall the GitHub app for this repo.
* [ ] Test a publish after landing, or wait for the next release. I'll
be available to help debug any issues that come up if the workflow
fails.

---------

Co-authored-by: UebelAndre <github@uebelandre.com>