Add automated Maven Central publishing via GitHub Actions

[jdiehl]

Summary

This PR adds automated publishing to Maven Central, replacing the current
manual/JitPack-only distribution with a fully automated CI/CD pipeline.
Addresses issue #634

Motivation

The project already has a mavenpush.gradle with Sonatype OSSRH configuration,
but no automation around it. This PR wires everything up so that creating a
GitHub Release automatically builds, signs, and publishes to Maven Central —
no manual steps required.
It also migrates from the legacy oss.sonatype.org endpoint to the new
Sonatype Central Portal (central.sonatype.com), which is the current
recommended approach as OSSRH is being sunset.

Changes

New files

• .github/workflows/ci.yml — builds and lints the :ucrop module on every
  push and pull request to master/main
• .github/workflows/publish.yml — publishes to Maven Central automatically
  when a GitHub Release is created

Modified files

• build.gradle — adds the
  gradle-nexus/publish-plugin
  (v2.0.0), configured to target the new Central Portal OSSRH Staging API
  endpoint; this enables fully automated staging close and release
• mavenpush.gradle — three improvements:
  • Removes the repositories block (now managed by the nexus publish plugin)
  • Fixes a duplicate AAR artifact issue (bundleReleaseAar was declared
    alongside from components.release, which already includes it)
  • Adds in-memory GPG signing support so that signing works in CI without a
    local GPG keyring

Required setup (one-time, by repo maintainer)

Before the publish workflow can run, the following must be configured:

1. Register on Sonatype Central Portal
Sign in at https://central.sonatype.com and verify the com.yalantis namespace
is claimed under your account.
2. Generate a Portal Token
Go to Account → Generate User Token. This produces a new username/password pair
(distinct from old OSSRH credentials).
3. Add GitHub Repository Secrets
In Settings → Secrets and variables → Actions, add:

Secret	Value
OSSRH_USERNAME	Portal token username
OSSRH_PASSWORD	Portal token password
SIGNING_KEY	ASCII-armored GPG private key: gpg --armor --export-secret-keys YOUR_KEY_ID
SIGNING_PASSWORD	GPG key passphrase

Publishing a release

1. Create a GitHub Release (e.g. tag v2.2.12)
2. The publish workflow triggers automatically
3. Artifacts are built, signed, uploaded to Central Portal staging, and
   released to Maven Central without any manual intervention
4. Monitor progress at https://central.sonatype.com/publishing/deployments

Testing

The CI workflow (ci.yml) runs on this PR to validate the build and lint
checks pass.