chore: secure tokens

[chrisba11]

This splits the secureliCI.yml workflow into a "Build & Test" workflow that runs on every push to any branch other than main and a "Publish" workflow that only runs on push to main. The Publish workflow will fall use the Build & Test workflow, so those jobs will run prior to releasing/publishing changes.

The primary focus of this is to stop using an org secret to house the GH App private key, so it is only accessible by workflows that use the publish environment, which is where the new environment secret exists that houses the private key. This keeps contributors from being able to modify a workflow to allow it to run code that will expose the contents of a secret. Now, any workflow attempting to use the Actions Helper GH App token must use the publish environment, which is only available from the main branch.

Resolves #275

[github-actions]

PR title failed to match (chore|style|test|feat|fix|docs): .+

All good!