Refactor action to use main Brioche installer script

[kylewlacy]

Up until now, setup-brioche included its own install script, which was an evolution of the old install script. Maintenance-wise, this was a pain, since we had to effectively make installer changes to both the install.sh script and to the version of the script in the setup-brioche action. And with the way the old installer worked, that also meant that we had to publish a new version of the setup-brioche action for each Brioche release!

This PR basically scraps the original install script, and now uses the new brioche-installer script instead. Unlike the previous version, we just download the installer script itself and run it. To maintain a similar security posture as before, we also verify the installer's signature before running it. See the "Releases" section of the brioche-installer README for details about signature verification (the verification code was basically copy/pasted from that README).

Also, to try and bring setup-brioche and brioche-installer closer together, I made a few changes to the inputs:

• There's a new install-bin-dir input, which corresponds to $BRIOCHE_INSTALL_BIN_DIR. When set, we also substitute the value of $HOME (using basic Bash string replacement).
• The install-dir input has been deprecated in favor of install-bin-dir. To maximize compatibility, it uses envsubst for string replacement when set.
• There's a new install-root input too, which corresponds to $BRIOCHE_INSTALL_ROOT. When set, we also substitute the value of $HOME (using basic Bash string replacement).
• Instead of setting a default value in action.yml, defaults are left unset. This lets the installer script decide what the default values should be.

...but there are still some differences compared to just calling the official install script directly:

• BRIOCHE_INSTALL_CONTEXT is set to github-actions unconditionally. The installer then handles $GITHUB_PATH, and also uses ::group:: to group the output
• There's no input to set BRIOCHE_INSTALL_VERIFY_SIGNATURE. Since the installer script itself gets verified, I didn't see a reason to opt-out of signature verification
• BRIOCHE_INSTALL_APPARMOR_CONFIG is set to auto by default. This mirrors our current behavior, and I think is a sensible default for CI pipelines.

[kylewlacy]

Oh yeah, I ran a few test workflows against this PR in the gh-actions-test repo (e.g. this run: https://github.com/brioche-dev/gh-actions-test/actions/runs/19187892929). Basically just to find any issues before merging!

[jaudiger]

Ok it looks good to me. Once this PR is merged, I'll update the test workflow to:

• add ARM test on stable (there is a FIXME for that)
• check the new options: install-bin-dir, install-root