ci: add `semantic-release` job
_Eventually_, we want to be able to drive `semantic-release` from Bazel. However, that requires hermetic resolution of `git` and `ssh` which is a challenge that we do not have time for at this time.
_Eventually_, we want to be able to drive `semantic-release` from Bazel. However, that requires hermetic resolution of `git` and `ssh` which is a challenge that we do not have time for at this time.