Update release action to create draft releases

[timonviola]

We want to enable immutable Github releases to default to better security practices, this is especially relevant for public/open-source repositories.

This is also a meaningful security improvement if we want to enable bots/agents to auto-merge on repositories e.g. dependabot (Related to https://github.com/SneaksAndData/terraform/issues/7687)

https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases

Before we do this, gh recommends:

We recommend you use the following workflow for publishing an immutable release.
Create the release as a draft.
Attach all associated assets to the draft release.
Publish the draft release.
This ensures that all assets are in place before the release becomes immutable, preventing the need to work around immutability restrictions.

Suggestion from @george-zubrienko :

i'd suggest we add "updated" workflow action that publishes draft release and then you can go click approve to promote it, or if you deny it removes the draft

[f-thiele]

triage: draft (approval, rejection) should be opt-in. Could be used for public repos. Internal repos can be put on immutable release immediately.