chore(ci): setup automated stainless builds

[dgellow]

What does this PR do?

This pull request adds a new workflow that does 2 things:

1. generate SDK preview builds whenever the OpenAPI spec file is modified in a PR
2. on PR merge, generate SDK builds that will be pushed to the different SDK repos (i.e start the release process)

Note

No repo secret STAINLESS_API_KEY is needed, the authentication is done automatically via GitHub OIDC.

Test Plan

I tested in my fork: stainless-api#3

[leseb]

Just added the STAINLESS_API_KEY key to the repo :)

[leseb]

I just realized that this can only work when NOT submitting a PR from fork given Github security model on passing secrets to workflow.

@dgellow I'm wondering how this is used elsewhere in practice and how other projects overcome that? Thanks!

[dgellow]

I'm moving this one back to draft until I have a great documented solution to share

[bbrowning]

Parts 1, 2, 3, and 4 of https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/ are important reading if we need to find a way to pass a secret into something triggered on every pull request.

[dgellow]

Thanks @bbrowning. I actually already read those articles, unfortunately there are a few details that are making the mentioned solutions a no-go for this repo.
However I have a great solution that won't require any CI secret. I expect to have it ready later today and will move the PR out of draft asap :)

edit: well, not exactly today, my plane internet is spotty