refactor: centralize Nextcloud App Store publication

[vitormattos]

Summary

Introduce a centralized composite action for Nextcloud App Store publication so consumer workflow YAML no longer needs to own build, signing, recovery, upload, and publication logic.

This first stage intentionally adds the action before changing the organization workflow template, so the follow-up template PR can pin a commit that is already part of main.

• add actions/nextcloud-appstore-publish
• preserve generic Krankerl and Makefile publication behavior
• expose explicit inputs for submodules, Makefile signing, setup-integrity verification, and manual recovery
• constrain manual recovery to a stable branch that contains the requested release tag
• keep tagged application source immutable during recovery
• pin all external actions to immutable SHAs
• replace release upload action with the runner gh CLI
• avoid GITHUB_ENV propagation for derived values
• extend workflow policy checks to composite actions
• add regression/contract tests for immutable uses, safe step ids, tagged source integrity, recovery ancestry, asset naming, and security-sensitive environment handling

A follow-up PR will reduce workflow-templates/appstore-build-publish.yml to a thin wrapper pinned to the merged action SHA.