Let an integration rotate its own client secret, and accept GitHub Actions OIDC for release uploads

Title: Let an integration rotate its own client secret, and accept GitHub Actions OIDC for release uploads Problem statement We upload source maps from GitHub Actions with a public integration: CI signs a jwt-bearer grant with the integration's client secret and gets an eight-hour installation token. That client secret is the one long-lived Sentry credential we hold, and we rotate it on a fixed cadence for SOC 2. Two gaps keep it a long-lived, human-rotated secret: 1. Self-rotation. POST /api/0/sentry-apps/{slug}/rotate-secret/ (added in #69015) accepts bearer tokens, but SentryAppRotateSecretPermission needs a token with org:write and an organization membership. The integration's own installation token has neither, because its proxy user has no OrganizationMember, so a rotation always needs a person with Manager or Owner. We tested this with an installation token on our integration and got a 403 at the scope gate. 2. Keyless CI uploads. #127086 added SENTRY_EXTRA_API_AU…