ci: use dedicated GITLAB_TOKEN_RELEASE_NOTES variable for notify-issues job

The notify-issues-on-release job was sharing GITLAB_TOKEN_RELEASE with the goreleaser job, which has broader permissions. This introduces a dedicated GITLAB_TOKEN_RELEASE_NOTES variable for the notify job, which only needs api scope to comment on and close issues.

To complete this change, add a GITLAB_TOKEN_RELEASE_NOTES CI/CD variable in Settings → CI/CD → Variables with a PAT (api scope) for the release bot account.