📦 Update workflow with configure_trusted_publisher

I ran `configure_trusted_publisher` to regenerate and configure trusted
publishing, and copied over most of what it created.  The only
significant difference is that it adds `step-security/harden-runner`.
The other changes are minor: renaming the workflow file and the GitHub
environment, using SHA1 checksums for the actions rather than tags, etc.

`configure_trusted_publisher` originally configured the trusted
publisher on rubygems.org _without_ any reference to the GitHub
environment.  But then I made the following PR:
rubygems/configure_trusted_publisher#9, and used that to generate a new
RubyGems Trusted Publisher config.

.github/workflows/release-gem.yml → .github/workflows/push_gem.yml

@@ -3,32 +3,42 @@ name: Publish gem to rubygems.org
 on:
   push:
     tags:
-      - v*
+      - 'v*'
+
+permissions:
+  contents: read
 
 jobs:
   push:
     if: github.repository == 'ruby/net-imap'
     runs-on: ubuntu-latest
 
-    permissions:
-      id-token: write # mandatory for trusted publishing
-      contents: write # required for `rake release` to push the release tag
-
     environment:
-      name: RubyGems
+      name: rubygems.org
       url: https://rubygems.org/gems/net-imap
 
+    permissions:
+      contents: write
+      id-token: write
+
     steps:
-      - uses: actions/checkout@v4
+      # Set up
+      - name: Harden Runner
+        uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@cacc9f1c0b3f4eb8a16a6bb0ed10897b43b9de49 # v1.176.0
         with:
           bundler-cache: true
-          ruby-version: 3.2
+          ruby-version: ruby
 
+      # Release
       - name: Publish to RubyGems
-        uses: rubygems/release-gem@v1
+        uses: rubygems/release-gem@612653d273a73bdae1df8453e090060bb4db5f31 # v1
 
       - name: Create GitHub release
         run: |