refactor(bazel): publish a separate .tar.gz (#24065)

Avoids mutating the protobuf tar.gz file that's created prior to the Bazel Central Registry publishing step.

Closes #24065

COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/24065 from protocolbuffers:alexeagle/bazel-tar c7df27ec9f
PiperOrigin-RevId: 821727519

.bcr/source.template.json

@@ -1,5 +1,5 @@
 {
   "integrity": "**leave this alone**",
   "strip_prefix": "{REPO}-{VERSION}",
-  "url": "https://github.com/{OWNER}/{REPO}/releases/download/{TAG}/{REPO}-{VERSION}.tar.gz"
+  "url": "https://github.com/{OWNER}/{REPO}/releases/download/{TAG}/{REPO}-{VERSION}.bazel.tar.gz"
 }

.github/workflows/release_bazel_module.yaml

@@ -18,7 +18,7 @@ jobs:
   release:
     uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.2.3
     with:
-      release_files: protobuf-*.tar.gz
+      release_files: protobuf-*.bazel.tar.gz
       prerelease: false
       tag_name: ${{ inputs.tag_name }}
       # The release was already created by Google-internal mechanism,

.github/workflows/release_prep.sh

@@ -7,7 +7,7 @@ set -o errexit -o nounset -o pipefail
 # https://github.com/bazel-contrib/.github/blob/v7.2.3/.github/workflows/release_ruleset.yaml#L104
 TAG=$1
 PREFIX="protobuf-${TAG:1}"
-ARCHIVE="$PREFIX.tar.gz"
+ARCHIVE="$PREFIX.bazel.tar.gz"
 ARCHIVE_TMP=$(mktemp)
 INTEGRITY_FILE=${PREFIX}/bazel/private/prebuilt_tool_integrity.bzl