GH-48838: [Release] Use gh cli to download sources for Linux packages and publish draft release before verification (#48839)

### Rationale for this change

With the change we did for immutable releases we required draft releases to be able to keep uploading artifacts during the release process. This means that the interim URL to download assets isn't the expected one on some of our scripts.

### What changes are included in this PR?

Update the `download_rc_archive` task so we use the GitHub cli tool instead of manually building the download URL for the source tar.gz from the release.
Update order of release scripts to publish the release before running verification tasks so the URL is the final one.

### Are these changes tested?

I have manually tested both the `gh release download` script and that the final URL will be the expected one once we move from draft to published release. I've tested creating a new release on my own fork here:
https://github.com/raulcd/arrow/releases/tag/test-release-rc2

### Are there any user-facing changes?

No

* GitHub Issue: #48838

Authored-by: Raúl Cumplido <raulcumplido@gmail.com>
Signed-off-by: Raúl Cumplido <raulcumplido@gmail.com>

Author: raulcd

.pre-commit-config.yaml

@@ -353,7 +353,7 @@ repos:
           ?^cpp/examples/minimal_build/run\.sh$|
           ?^cpp/examples/tutorial_examples/run\.sh$|
           ?^dev/release/05-binary-upload\.sh$|
-          ?^dev/release/07-binary-verify\.sh$|
+          ?^dev/release/08-binary-verify\.sh$|
           ?^dev/release/binary-recover\.sh$|
           ?^dev/release/post-03-binary\.sh$|
           ?^dev/release/post-08-docs\.sh$|

dev/release/08-publish-gh-release.sh dev/release/07-publish-gh-release.shdev/release/08-publish-gh-release.sh renamed to dev/release/07-publish-gh-release.sh

@@ -59,11 +59,15 @@ class ApacheArrowPackageTask < PackageTask
   end
 
   def download_rc_archive
-    base_url = "https://github.com/#{github_repository}"
-    base_url += "/releases/download/apache-arrow-#{@version}"
     archive_name_no_rc = @archive_name.gsub(/-rc\d+(\.tar\.gz)\z/, "\\1")
-    url = "#{base_url}/#{archive_name_no_rc}"
-    download(url, @archive_name)
+    sh("gh",
+       "release",
+       "download",
+       "apache-arrow-#{@version}",
+       "--clobber",
+       "--repo", github_repository,
+       "--pattern", archive_name_no_rc)
+    mv(archive_name_no_rc, @archive_name)
   end
 
   def download_released_archive

dev/release/07-binary-verify.sh dev/release/08-binary-verify.shdev/release/07-binary-verify.sh renamed to dev/release/08-binary-verify.sh

@@ -246,7 +246,8 @@ Build source and binaries and submit them
     archery crossbow status <crossbow-build-id>
 
     # Download the produced binaries
-    # This will download packages to a directory called packages/release-<version>-rc<rc-number>
+    # This will download packages generated from the archery tasks
+    # to a directory called packages/release-<version>-rc<rc-number>
     dev/release/04-binary-download.sh <version> <rc-number>
 
     # Sign and upload the binaries
@@ -263,11 +264,14 @@ Build source and binaries and submit them
     # NOTE: You need to have GitHub CLI installed to run this script.
     dev/release/06-matlab-upload.sh <version> <rc-number>
 
+    # Move the Release Candidate GitHub Release from draft to published state
+    # This will update the artifacts download URL which will be available for the
+    # verification step.
+    dev/release/07-publish-gh-release.sh <version> <rc-number>
+
     # Start verifications for binaries and wheels
-    dev/release/07-binary-verify.sh <version> <rc-number>
+    dev/release/08-binary-verify.sh <version> <rc-number>
 
-    # Move the Release Candidate GitHub Release from draft to published state
-    dev/release/08-publish-gh-release.sh <version> <rc-number>
 
 Verify the Release
 ------------------