Split out the "publish" step from _support/release

The "publish" step of _support/release always pushes to gitlab.com, which is not what we want during a security release. This change moves that step into _support/publish, so that you have an easier choice to publish or not after creating a tag + changelog with _support/release.

Related to #1645 (closed)