Add Slack-to-GitHub Actions integration via dotcms-github-app

Description

Extend the dotcms-github-app to support triggering GitHub Actions workflows from Slack — starting with release generation.

Context: The release process currently requires manual GitHub Actions triggers. The goal is to allow stakeholders to approve and trigger releases directly from Slack, with the option to schedule a bot that asks 2–3×/week whether a release should be cut.

Why the GitHub App (not a standalone Lambda):

• Avoids a one-off Lambda that gets forgotten and duplicated
• The App already responds to GitHub events — adding Slack interactivity (buttons, slash commands) gives us a reusable framework for any Slack ↔ GitHub integration (workflow triggers, deployment approvals, notifications)
• Bot tokens are more secure than PATs stored as secrets
• Can attribute actions to specific users via OAuth rather than an anonymous bot

Initial PR / proof of concept: https://github.com/dotCMS/dotcms-github-app/pull/13

Security requirements (per Mehdi):

• Separation of privileges — each bot/service account must have its own distinguished token
• Follow the existing dotCMS-Machine-User pattern: separate PAT per use case, scoped to lowest possible access
• No admin-level tokens exposed to Slack users

Slack thread: https://dotcms.slack.com/archives/C028Z3R2D/p1772551690635289

Acceptance Criteria

• dotcms-github-app can receive Slack interactive payloads (button clicks / slash commands) and verify Slack request signatures
• App can trigger the release generation workflow in dotCMS/core upon Slack approval
• Tokens follow separation-of-privileges: dedicated bot token scoped to minimum required permissions
• No GitHub PATs or admin tokens are exposed to Slack users
• Slack interaction is attributed to the requesting user (at minimum logged, ideally via OAuth)
• Documentation/runbook added so the App is maintainable by any Java developer (shared ownership, not single-person dependency)

Additional Context

Participants: Nollymar Longa, Steve Bolton, Mehdi Karimi, Steve Freudenthaler

Future enhancements (out of scope for this issue):

• Scheduled Slack bot that asks stakeholders if a release can be cut (2–3×/week)
• Automated pre-release checks (e.g., has it already run in the last N hours)
• Live release status updates posted back to Slack
• Full OAuth-based user impersonation for GitHub API calls

Start by reviewing the dotcms-github-app and its proof-of-concept PR 13, then inspect the release-generation workflow in dotCMS/core. Trace how Slack interactive requests would be received and authenticated, and confirm the required permissions and user attribution. Done means the acceptance criteria are met, including a maintainable Java runbook.