Automatic Sonatype publication from CI is still broken

[ndw]

I think the problem is that "bearer token" refers to both the GitHub API bearer token and the sonatype bearer token and they're not distingushed. (I think the bearer token secret is the GitHub one, not the sonatype one.)