feat: release fixtures

[oggy-dfin]

To get better coverage on upgrades, we want to run some tests on fixtures produced by the mainnet version. Here's the basic workflow:

1. There's a CI-generated bazel file called release_fixtures.bzl that contains the metadata about where the fixtures are uploaded and what their sha256 sum is
2. Based on this file we generate a bunch of http_file rules in WORKSPACE.bazel, one for each fixture, that can then be used in tests
3. There's a rust_fixture_generator rule that essentialy defines a Rust binary that produces a fixture (on stdout) and generates the fixture out of it
4. There's an upload_fixtures rule (defined in uploads.bzl and invoked in publish/fixtures/BUILD.bazel) that takes rust_fixture_generator (defined in fixtures.bzl) rules as inputs, and uploads their generated files using upload_artifacts, also producing a new release_fixtures.bzl
5. There is a GitHub CI job (currently defined in .github/workflows/preview-fixtures.yml - should rename once finalized) that's meant to be run on releases, that will trigger upload_fixtures, take the new release_fixtures.bzl file, and then create a PR to update this file on master. Currently the PR will need a manual approval, but we will want to switch this to be automatically merged once we're confident it works (and we figure out how to do this)