ci: add semantic-release

[alexashley]

Also updates the README, as it was missing a few flags

[rcoy-v]

This is using semantic release to only create a tag, which will start the separate build workflow with go releaser, correct? Could we, or does it make sense to, have semantic release also handle the release like the policy repository? https://github.com/liatrio/gh-trusted-builds-policy/blob/main/.releaserc#L21

[alexashley]

This is using semantic release to just create a tag, which will start the separate build workflow with go releaser, correct

It shouldn't trigger a new workflow run, I removed the tags trigger and changed the release job to always run on main. Goreleaser just runs after and it should have the local tag.

The Goreleaser docs have an example of integrating with semantic-release but it's just using the exec plugin to run goreleaser. I don't see that as too different from just running the action, especially if we aren't going to create releases locally https://goreleaser.com/cookbooks/semantic-release/#example-semantic-release