extract the jq filter to Heredoc

Easier to understand what it is doing

.github/workflows/release_prep.sh

diff --git a/.github/workflows/release_prep.sh b/.github/workflows/release_prep.sh
index cd7c9eb..5f2ea54 100755
--- a/.github/workflows/release_prep.sh
+++ b/.github/workflows/release_prep.sh
@@ -6,8 +6,6 @@
 # Argument provided by reusable workflow caller, see
 # https://github.com/bazel-contrib/.github/blob/v7.2.3/.github/workflows/release_ruleset.yaml#L104
 TAG=$1
-# HACK during debugging, to allow us to fetch older release artifacts.
-RELEASE_ARTIFACT_TAG=v32.0
 PREFIX="protobuf-${TAG:1}"
 ARCHIVE="$PREFIX.tar.gz"
 ARCHIVE_TMP=$(mktemp)
@@ -22,13 +20,26 @@
 # Delete the placeholder file
 tar --file $ARCHIVE_TMP --delete $INTEGRITY_FILE
 
+# Use jq to translate GitHub Releases json into a Starlark object
+filter_releases=$(cat <<'EOF'
+# Read the file assets already present on the release
+reduce .assets[] as $a (
+  # Start with an empty dictionary, and for each asset, add
+  {}; . + {
+    # The format required in starlark, i.e. "release-name": "deadbeef123"
+    ($a.name): ($a.digest | sub("^sha256:"; "")) 
+  }
+)
+EOF
+)
+
 mkdir -p ${PREFIX}/bazel/private
 cat >${INTEGRITY_FILE} <<EOF
 "Generated during release by release_prep.sh"
 
 RELEASED_BINARY_INTEGRITY = $(
-curl -s https://api.github.com/repos/protocolbuffers/protobuf/releases/tags/${RELEASE_ARTIFACT_TAG} \
-  | jq 'reduce .assets[] as $a ({}; . + { ($a.name): ($a.digest | sub("^sha256:"; "")) })'
+curl -s https://api.github.com/repos/protocolbuffers/protobuf/releases/tags/${TAG} \
+  | jq -f <(echo "$filter_releases")
 )
 EOF