Publish releases to the Code Genome Project as well as the plugin portal

[timtebeek]

Why v7.40.0 is missing from CGP

• The CGP cutover in Cut over to the Code Genome Project for publishing and org.openrewrite resolution #467 switched ci.yml's snapshot step from
  publishPluginMavenPublicationToSonatypeRepository to
  ...ToCgpRepository, but never touched publish.yml. Tagged releases have
  only ever run final publishPlugins.

The v7.40.0 release job
confirms it — the task list ends at:

> Task :plugin:publishPlugins
> Task :postRelease
> Task :final
BUILD SUCCESSFUL in 54s

No publishPluginMavenPublicationToCgpRepository, so the artifact went to the
Gradle Plugin Portal and nothing was uploaded to
s3://codegenome-artifacts/maven. Hence the empty
org/openrewrite/plugin/ on artifacts.codegenomeproject.org. Nothing failed;
the step was simply never asked to run.

Fix

Adds :plugin:publishPluginMavenPublicationToCgpRepository and the
CGP_AWS_* credentials to both the candidate and release steps, mirroring
what ci.yml already does for snapshots.

Backfilling 7.40.0

This only fixes releases from here on. 7.40.0 itself still needs a one-off
upload — either a local run with the CGP AWS credentials:

./gradlew -Preleasing -Prelease.useLastTag=true \
  :plugin:publishPluginMavenPublicationToCgpRepository

or cutting v7.40.1 once this merges. Re-running the existing tag's workflow
won't help: it would use the workflow file as of that tag, and publishPlugins
would fail on an already-published version.