After the recent changes to the `GITHUB_TOKEN`, the `build.yml` workflow can no longer push the release artifacts to the GitHub release: https://github.com/canonical/chisel/actions/runs/24026969346

This PR replaces the `GITHUB_TOKEN` with a new one, managed by us. This new token has `contents: write` permissions (similarly to the `GITHUB_TOKEN`), which are unfortunately broad, because GitHub does not offer fine-grained control for releases. The use of the secret is bound to a single step, which runs our own CI script, and always in the context of the base repo and on `release` events.

Avoid collisions between scan results for the different arch-specific artifacts.
Also set the needed permissions on the GITHUB_TOKEN to upload the security report. A fine-grained token cannot be used as this specific action only accept the GITHUB_TOKEN.

Fixes the long-standing bug in #63.

Rename two errors and remove the associated linter exclusions to comply with ST1012.

This PR fixes a common bug when handling strings in Go. The for loop:

for bi, br := range b {
    ...
    lst[bi+1] = cost
}

Is iterating over a string and using bi which is the byte offset to store things in lst instead of the current rune count. In the case where the characters are ASCII it works because each rune is 1 byte but in the case of runes that take more than 1 byte this fails (see the added test case).

Add workshop configuration, with agent SDKs to enable standard agent-based work.

Some package stores only publish SHA3-384 hashes. This PR enables storing entries in the cache using
SHA3-384 hashes. Consumers of the cache package must now explicitly select the algorithm to be used
to create/write/read an entry.

Chisel intermittently fails with `expected digest X, got Y` when Ubuntu's archive is mid-publication and InRelease is temporarily inconsistent with `Packages.gz` at the named path (a window we observed lasting at least 39 minutes  against the same publication in real CI runs for [Ella Core](https://github.com/ellanetworks/core)). Fetch the package index by content hash using apt's `Acquire-By-Hash` , which Ubuntu archives have advertised since 16.04 (2016), so the URL itself encodes the expected bytes; falls back to the named path when an archive doesn't advertise the feature or a specific hash has been garbage-collected.

Fixes #295 

Reference: https://wiki.debian.org/DebianRepository/Format#Acquire-By-Hash