Improve workflows

[jsoref]

This fixes/improves a number of items for CI:

1. Updates to current versions of actions (the old versions use obsolete versions of node and github wants to drop support for them)
2. Moves away from using ${{ ... }} in run: statements (which is considered bad practice)
3. Uses github.token instead of secrets.GITHUB_TOKEN -- they reference the same thing but the former should be preferred
4. Moves name: field before run:
5. Adds permissions to jobs
6. Makes workflow stop if it can't publish
   The existing workflow behavior for ci.yml is to run for 6 hours (the default github workflow time limit) which is really expensive as it blocks one of a user's 20 runner slots for 6 hours.

Note that this is only mostly tested. I can't get various things to pass -- some things appear to expect to run in this repository, and a bunch of things require pre-existing releases and I couldn't figure out how to synthesize those either.