feat: pass release-please-approver secrets through in gen workflows

[fiunchinho]

Summary

Generated `release-please.yaml` now forwards two new optional secrets — `RELEASE_PLEASE_APPROVER_CLIENT_ID` and `RELEASE_PLEASE_APPROVER_PRIVATE_KEY` — to the reusable `giantswarm/github-workflows` `release.yaml`. These back a dedicated `release-please-approver` GitHub App that submits an approving review on release-please PRs, satisfying branch protection's required-approval rule so `--auto --squash` can complete the merge once required checks pass.

Pairs with giantswarm/github-workflows#192, which is what adds the auto-approve step in the reusable workflow. Without this devctl change, every release-please-using repo would need a hand-edited PR to wire the new secrets through.

Why this is needed

`gh pr merge --auto` never completes on release-please PRs in repos with required-approval branch protection, because nothing satisfies the approval requirement:

• The PR author is the `release-please-workflow` App, which cannot self-approve.
• No human is meaningfully reviewing the auto-generated CHANGELOG diff.
• `bypass_pull_request_allowances` on classic branch protection does not allow merging un-approved PRs via the API — only direct branch pushes (empirically verified).

Adding a dedicated approver App whose review counts is the smallest fix that preserves "human review required for normal PRs" while letting release PRs flow through.

Backwards compatibility

Both new secrets are `required: false` upstream. Repos that don't have the App installed or the org secrets configured see no behavior change — the auto-approve step is gated on the secrets being non-empty. Existing release-please repos that re-run devctl just get two extra harmless secret pass-throughs in their generated workflow.

Important caveat for adopters

The `release-please-approver` App needs `Pull requests: Read and write` AND `Contents: Read and write` permissions. `Contents: Read` alone is silently disregarded by branch protection — the review is recorded as `APPROVED` but `reviewDecision` stays `REVIEW_REQUIRED` and `authorAssociation` reports `NONE`. This is poorly documented; flagging it here so the next person installing the App doesn't lose an hour to it (I did).

Test plan

• Built locally with `go generate ./... && go build ./...` — clean.
• End-to-end verified on `giantswarm/test-release-please` (with the equivalent workflow pin and secrets wired manually): release-please PR auto-approved by `release-please-approver[bot]` → `--auto` merged it → v1.0.0 tag + GitHub release created in ~30s from the triggering push.
• After merge: re-run devctl across a representative subset of release-please-using repos to confirm the generated diff is minimal and correct.