Change CI to GitHub Actions

[Dekker1]

Replaces the GitLab CI setup with GitHub Actions across the MiniZinc
repositories (minizinc-vendor, libminizinc, mzn-analyse, FindMUS,
Globalizer, MiniZincIDE).

What this covers

• Build, test, package and publish for every supported platform, now
  including x86_64-apple-darwin and aarch64-windows.
• Code signing: Windows installers via Azure Trusted Signing, macOS
  bundles signed, notarised and stapled (app and .dmg both).
• Rolling edge prereleases on develop; tagged releases cut by hand,
  one repository at a time.
• CLI bundles and container images (GHCR, multi-arch) built from
  published releases rather than rebuilt.
• Dependencies pinned per version in minizinc-vendor and consumed
  through vendor.lock, replacing the old "latest from master" fetch.

Verified

A full release was rehearsed end to end under a throwaway 0.0.0 tag
across all four repositories: builds, tests, signing, notarisation,
release publication, CLI bundles and container images. The tag,
releases and artefacts from that trial have been removed.

Checklist

• Changes are ready for inclusion in next release
• Changelog has been updated, or no changes required
• Test cases changed or added, or no changes required
• Documentation altered, or no changes required
• Pull request(s) opened for required changes to upstream repos, or none required