feat: Immutable releases support

[scop]

https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases

Closes #3720

Caveat: untested beyond test suite.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.11%. Comparing base (1b53270) to head (bf4be06).
⚠️ Report is 11 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #3725   +/-   ##
=======================================
  Coverage   91.11%   91.11%           
=======================================
  Files         187      187           
  Lines       16686    16686           
=======================================
  Hits        15204    15204           
  Misses       1295     1295           
  Partials      187      187           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[gmlewis]

Thank you, @scop!
Can you please fix the linter errors, and then we will review the PR?

[scop]

Oops, done.

[alexandear]

We can't set Immutable in CreateRelease, see https://docs.github.com/en/rest/releases/releases?apiVersion=2022-11-28#create-a-release--parameters

[gmlewis]

We can't set Immutable in CreateRelease, see https://docs.github.com/en/rest/releases/releases?apiVersion=2022-11-28#create-a-release--parameters

If I understand correctly, @alexandear, this is a case where the documentation does not properly reflect the actual behavior of the system. In #3720 there is a demonstration using curl of receiving the immutable field, so it does indeed appear to exist.

[scop]

This added line is in a section commented as "Fields to be removed". It contains a bunch of other fields that I suppose one cannot set when creating a release, such as the release id, created at, published at, etc. IIUC the purpose of having these set here is to verify that we will not be sending them in create requests even if they're set.

[gmlewis]

Thank you, @alexandear!
Merging.

[gmlewis]

Thank you, @scop and @alexandear!
LGTM.
Merging.