Release Go-native tool

Rewrite `release.sh` script (https://github.com/knative/hack/blob/main/README.md#using-the-releasesh-helper-script) into a Golang tool `knative.dev/toolbox/releaser`.

Invent new Go-native extension interface, for example:

```sh
# will look for Go files with `release` build constraints, that register build configuration
go run knative.dev/toolbox/releaser@latest ./ \
--dot-release \
--release-gcs knative-releases/kn-plugin-event \
--release-gcr gcr.io/knative-releases \
--github-token /etc/hub-token/token \
--apple-codesign-key /etc/notary/cert.p12 \
--apple-notary-api-key /etc/notary/key.json \
--apple-codesign-password-file /etc/notary/password \
--branch release-1.9
```

The release configuration might look like:

```go
//go:build release
package serving

import (
"fmt"
"os"

// Implemented with `github.com/bitfield/script` or similar
"knative.dev/pkg/kscript/ko"
"knative.dev/toolbox/releaser/pkg/config"
)

init {
config.Configure(function(ctx config.Context) {
f := must[*os.File](ko.Resolve("config").AsFile("release.yaml"))
ctx.AddAsArtifact(f)
})
}

func must[T any](ret T, err error) T {
if err != nil {
panic(err)
}
return ret
}
```

Start with the existing release.sh workflow described in the README's “using the release.sh helper script” section, then compare it with the proposed knative.dev/toolbox/releaser entry point and pkg/config interface. Define the Go-native extension model and support the listed release and signing options; done means the new tool can replace the helper script for the shown release flow.

Written by the indexing model from the issue text.