release-23.2: release tooling: bundled backport of GHA-migration follow-ups

[rail]

Backport of the GHA-migration follow-ups onto release-23.2 so the new GitHub
Actions release pipeline can drive 23.2 patch releases on behalf of @rail.

Mirrors the release-24.1 (#170823) recipe — pkg/cmd/release lifted from
release-26.1, GHA workflows + build/github/release-*.sh wrappers added,
shared TeamCity-era scripts lifted from release-26.1 (their edits are
additive WIF-auth branches gated on
CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE, so the legacy TeamCity code
paths still work).

Trimmed for release-23.2's scope. The following workflows / scripts
from upstream were intentionally dropped — they aren't run on this
branch:

• IBM build/sign (build-per-platform-ibm, build-docker-ibm,
  ibm-signing, release-sign-ibm.sh) — release-23.2 doesn't ship IBM
  / linux-s390x.
• Cloud-only image (publish-cloud-only, cloud-rollout,
  release-cloud-only.sh, release-cloud-rollout.sh,
  build-cockroach-release-cloud-only.sh).
• RAFA rollout (create-rafa-prs, release-publish-rafa-prs.sh).

Dep changes mirror the 24.1 backport:

• cockroachdb/version added as a new dep, go-github/v61 added, plus
  transitive bumps cockroachdb/errors v1.11.3, getsentry/sentry-go v0.27.0,
  google/go-cmp v0.6.0, stretchr/testify v1.10.0.
• Orphaned legacy deps dropped: andygrunwald/go-jira,
  google/go-github/v42, indirect trivago/tgo. DEPS.bzl +
  distdir_files.bzl updated.

Branch-specific patches (same as 24.1):

• verify_docker_image reverted to FIPS detection via Go version +
  OpenSSL fingerprint.
• TEAMCITY_BUILD_PROPERTIES_FILE mount removed from run_bazel.
• linux-s390x dropped from matrices and platform iteration.
• build-cockroach-release-per-platform.sh uses
  publish-provisional-artifacts -provisional -release and restores
  the --build-arg fips_enabled=1 branch for the FIPS docker image.

Release justification: release-tooling backport for GHA migration.

Epic: none
Release note: None

[blathers-crl]

Thanks for opening a backport.

Before merging, please confirm that it falls into one of the following categories (select one):

• Non-production code changes OR fixes for serious issues. Non-production includes test-only changes, build system changes, etc. Serious issues are defined in the policy as correctness, stability, or security issues, data corruption/loss, significant performance regressions, breaking working and widely used functionality, or an inability to detect and debug production issues.
• Other approved changes. These changes must be gated behind a disabled-by-default feature flag unless there is a strong justification not to. Reference the approved ENGREQ ticket in the PR body (e.g., "Fixes ENGREQ-123").

Add a brief release justification to the PR description explaining your selection.

Also, confirm that the change does not break backward compatibility and complies with all aspects of the backport policy.

All backports must be reviewed by the TL and EM for the owning area.

[blathers-crl]

Your pull request contains more than 1000 changes. It is strongly encouraged to split big PRs into smaller chunks.

_{🦉 Hoot! I am a Blathers, a bot for CockroachDB. My owner is dev-inf.}

[cockroach-teamcity]

This change is