ci: use protected environment for release cut job

This is an attempt to allow non-maintainer engineers to cut new releases, following https://about.gitlab.com/blog/2020/02/20/protecting-manual-jobs.