add new upload-release script

This introduces a new release script for nix-based releases.
Compared to the old version this improves the following aspects:

- fully type checked
- no longer depends on beeing executed on eelco's laptop
- no dependency on the third-party libraries compared to the old version
  (aws, LWP, json parser etc.)
- self-test and dry run mode to test releases without having specific
  access to release buckets or docker registry.
  The results of a release can be visually inspected and debugged locally.
- improved error handling and logging
- ci-friendly: all dependencies are managed by nix and locked by the local flake
- no dependency on an external docker daemon by using podman
- more arguments and documented help to publish releases in different buckets/registry