[Release] Improve post-11-bump-versions.sh to avoid possible stray commits to reaching main

### Describe the enhancement requested

In the `post-11-bump-versions.sh` we push directly to main. I already created an issue in the past that I thought we could modify it to not push: https://github.com/apache/arrow/issues/33931

For the 12.0.1 patch release I accidentally had some issues when executing the script due to the Debian package versions failing to be updated. It was successful when I used: `BUMP_DEB_PACKAGE_NAMES=0`
When it finally executed correctly it pushed a lot of testing commits I had done locally to understand what the issue was plus some stray commits from previous executions as seen here:
https://github.com/apache/arrow/compare/f08670bd20e81ae79f33e66256927f584ae62d02...e53db939bfad2f20e332172ab4f453add1dc680d

As seen on those commits I pushed a new commit reverting the bad ones.

In order to avoid this from happening in the future we could:
* Validate when executing the script that local history does not differ from upstream. There are no stray commits.
* Do not push directly but show the command and prompt to push, asking the user to validate history before pushing.

### Component(s)

Developer Tools, Release

Start by reading post-11-bump-versions.sh and trace the path that updates Debian package versions and pushes to main, including the BUMP_DEB_PACKAGE_NAMES=0 case. Compare the local history with upstream before the push step, or review how a confirmation prompt could expose the command; done means the script cannot unknowingly push stray commits.

Written by the indexing model from the issue text.