Migrate workflow secrets to AWS Secrets Manager

[devPalacio]

Summary:

• Fetch Maven Central and signing credentials from AWS Secrets Manager via GitHub OIDC.
• Replace GitHub repository secret references in the publish job.
• Upgrade GitHub Actions versions used by the workflow.

Validation:

• Parsed workflow YAML locally.
• Ran git diff --check.
• Confirmed no remaining secrets.* workflow references.