ci: assume role for RubyGems on release

[svenne87]

Enlig vad jag förstår ska vi efter dessa ändringar kunna hoppa API-nyckel helt. Just `environment` var valritt men uppmanat.

---

Note

Medium Risk
Release publishing depends on RubyGems OIDC, the release environment, and correct GitHub/RubyGems trusted-publisher setup; misconfiguration would block gem pushes but does not change runtime gem code.

Overview
Release publishing no longer uses RUBYGEMS_API_KEY. Both publish-native-gems and publish-gem now request id-token: write, run in the release GitHub Environment, and call rubygems/configure-rubygems-credentials@v2.1.0 before gem push, so RubyGems auth comes from OIDC/trusted publishing instead of a stored API key.

CI workflow bumps actions/checkout to v7; the release workflow also upgrades upload-artifact / download-artifact and checkout to newer major versions, with minor step spacing in main.yml.

^{Reviewed by Cursor Bugbot for commit ea8e3f7. Bugbot is set up for automated code reviews on this repo. Configure here.}