Enable GitHub immutable releases

[ArchangelX360]

Could we enable GitHub immutable releases?
https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases

[ChayimFriedman2]

This will need to be done by infra admins since it requires changing the repo settings; you can talk to them on Zulip.

[lnicola]

It's not enough. You can't add assets to an immutable release. I don't know how the UI wires things up, but in https://octokit.github.io/rest.js/v22/#repos-create-release there's no way at all to upload assets. So here we'll have to create a draft release, upload the assets, then publish it.

We could also switch to gh, though.