Add publish workflow, rename galaxy.yaml to yml.

The publish workflow packages the collection, then attempts to publish
it using the release tag name stripped of its leading "v". If the tag
name and the galaxy.yml version name do not match, ansible-galaxy will
fail to find the tarball.

.github/workflows/publish.yaml

@@ -0,0 +1,22 @@
+- name: Deploy collection to galaxy
+  on:
+    release:
+      types:
+        - released
+
+  jobs:
+    publish:
+      runs-on: ubuntu-latest
+      steps:
+        - uses: checkout@v4
+          with:
+            ref: ${{ github.ref }}
+
+        - name: Build collection
+          run: ansible-galaxy collection build
+
+        - name: Get expected version string
+          shell: VERSION=$(echo "${{ github.ref_name }}" | sed -e 's/v([0-9]*\.?){3}/\1/')
+
+        - name: Publish to Galaxy
+          run: ansible-galaxy collection publish tofugarden-secureboot-$VERSION.tar.gz --token ${{ secrets.GALAXY_API_KEY }}