CI: add automate Chrome Web Store publishing with service account

[iuyo5678]

Summary

This PR automates Chrome Web Store publishing as part of the existing extension release workflow.

When an ext-v* tag is pushed, the workflow now:

• Builds and uploads the Chrome extension ZIP artifact.
• Creates the existing GitHub Release.
• Starts a protected publish-cws job.
• Authenticates with a Google Cloud service account using a signed JWT.
• Uploads the ZIP through Chrome Web Store API v2.
• Polls fetchStatus when the upload is processed asynchronously.
• Submits the extension using DEFAULT_PUBLISH after the upload succeeds.

Security

• The service account JSON is stored in the protected chrome-web-store GitHub Environment.
• Environment approval is required before the publishing job can access the secret.
• The service account JSON is only exposed to the authentication step.
• The generated access token is masked before being passed to subsequent steps.
• The publishing job only has contents: read repository permission.
• API requests do not enable verbose or trace logging.

The pre-processing steps have been completed

1. The relevant Google Cloud APIs have been enabled
2. The service account has been applied for
3. The service account has already been linked in the Chrome Web Store Developer Dashboard
4. The relevant environment secrets have been configured.

Validation

• YAML syntax parsing passed.
• Embedded Bash syntax check passed.
• Embedded Node.js syntax check passed.
• git diff --check passed.
• The live Chrome Web Store API was not invoked during local validation.

变更说明

本 PR 在现有扩展发布 workflow 中增加了 Chrome Web Store 自动发布流程。

推送 ext-v* tag 后，workflow 现在会：

• 构建并上传 Chrome 扩展 ZIP artifact。
• 创建原有的 GitHub Release。
• 启动受保护的 publish-cws job。
• 使用 Google Cloud 服务账号签署 JWT 并完成认证。
• 通过 Chrome Web Store API v2 上传 ZIP。
• 遇到异步上传时，轮询 fetchStatus 等待处理完成。
• 上传成功后使用 DEFAULT_PUBLISH 提交审核发布。

安全措施

• 服务账号 JSON 存储在受保护的 chrome-web-store GitHub Environment 中。
• 发布 job 只有在 Environment 审批通过后才能读取 Secret。
• 服务账号 JSON 仅注入认证步骤。
• 获取到的 access token 在传递给后续步骤前会被隐藏。
• 发布 job 仅具有 contents: read 仓库权限。
• API 请求未开启 verbose 或 trace 日志。

前置处理流程已经完成

1. 已经开启相关google cloud api
2. 已申请的service account
3. service account已经已在 Chrome Web Store Developer Dashboard 中关联
4. 相关的 environment secret 已经配置。

验证情况

• YAML 语法解析通过。
• 内嵌 Bash 语法检查通过。
• 内嵌 Node.js 语法检查通过。
• git diff --check 通过。
• 本地验证未实际调用 Chrome Web Store API。

[BB-fat]

LGTM