chore: add automation for release keys - #2603

I'm not sure if it should be part of the documented advice, but I would recommend disabling the workflow Automatically update Docker image versions before merging a PR with only key changes. That prevents immediate PR creation for a new Docker version release, and delays updating Dockerfile instances until there is an actual release using the changed key list.

@MikeMcC399 I changed the cron frequency to weekly, and added a body parameter for the PR creation.
edit: First force push was missing the body, but fixed now

Running this workflow will fix the keys order difference described in #2569.

@nodejs/releasers would it make sense to include your group as "reviewers" in the generated PRs for visibility, or would that just be noise?

I'm not sure a cron is the correct way forward, a linter would be much better, avoiding "invalid" data to be merged in rather than correcting it after-the-fact

@aduh95 I added a second plain CI/check action too. I can keep both, or drop the cron one if you think the releasers prefer to open the PRs here manually

I'm not sure, an automated process makes it easier for a "bad" change to make its way here (i.e. someone getting write access to release-keys to affect docker-node); it really depends on thorough the review process actually is for this kind of automated PRs

I suggest to go ahead with landing this PR. It does not introduce any new risks, and helps ensure that the key list is aligned.

All PRs are subject to approval by the @nodejs/docker team and there is no automated key list update in this repo that takes place without approval.

I suggest getting a green CI first. If there are automated PRs, mandating reviews from releasers as suggested in #2603 (comment) makes sense

The CI failure is due to the mismatched ordering of keys:

-A363A499291CBBC940DD62E41F10027AF002F8B0
 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD
+A363A499291CBBC940DD62E41F10027AF002F8B0

If the error is not corrected prior to this PR landing, or as part of the PR, then it would have the advantage of exercising the automated key mismatch detection, PR correction creation and approval process.

I would defer to @nschonni for that decision.