Add backport publish command

[tianyiy-tim]

Issues:

Addresses P425131803

Description of changes:

After apply you're left with one local branch per affected branch, and opening a pull request for each of them is still manual. For a fix that hits seven branches that's seven trips through the GitHub UI.

This pull request adds publish, which pushes those branches and opens one pull request each, in one command.

Most of the time you never type it. apply --open-pr offers to run it as soon as the cherry-picks are done, so a local session stays analyze then apply.

Stacked on #3414. The base here is backport-stack/apply, a scaffolding branch holding the commits below it, so this diff is only the 9 files this change touches. I will retarget it to main as the stack lands. Please don't merge it into the scaffolding branch.

Call-outs:

• Branches go to your fork, pull requests are opened against aws/aws-lc. Pushing branches to aws/aws-lc is refused, so a mistyped --remote can't put half-reviewed work on the real repository.

• Whether a branch is ready is read from git, not from anything apply recorded. So resolving a conflict by hand is enough for the next publish to pick that branch up, with no need to run apply again.

• A branch that already has an open pull request is left alone, so re-running is safe.

• Nothing is ever a draft and nothing is auto-merged.

• Everything that talks to GitHub lives in util/github.py, so a second command needing to open a pull request later reuses this one rather than growing its own. The previous version of this tool grew two openers and they drifted apart.

• A fix that reaches inside crypto/fipsmodule/ puts a FIPS boundary warning at the top of every pull request body and in the summary comment, plus a "needs FIPS review" line. analyze already prints it, but nobody reviewing a backport ran analyze, and the module is validated as a build of exactly that source. publish never reads the diff, so the file list comes from the saved run.

• --dry-run pushes nothing, opens nothing, and prints the summary comment instead of posting it. It used to print what it would push and then comment on the source pull request anyway, which belongs to whoever wrote the fix. It also reports how many pull requests it would have opened, rather than "0 opened", which read as nothing to do.

• gh is a new prerequisite, for this command only.

Testing:

Unit tests - 34 new, 188 total:

python3 -m unittest testing.test_engine

They cover reading a remote URL, the refusal to push to aws/aws-lc, how a branch is named to GitHub across repos versus within one, each outcome a branch can end in, that a dry run posts no comment while a real run does, and that the FIPS warning reaches both the pull request body and the summary.

Real fix - ran the whole chain against #3105 (the CRL scope check) with the release branches wound back to before its backports existed, so the tool had to work them out: analyze flagged the three branches that really did get backports, apply cherry-picked onto all three, and publish --dry-run reported those three and the conflicted ones separately. The three commits apply produced have the same patch-id as the human backports in #3109, #3106 and #3110.

Also verified --remote upstream is refused before anything is printed or pushed, and that resolving one conflict by hand moved that branch from unfinished to publishable without re-running apply.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

[github-actions]

🔒 Security Review — View Report

Please review before merging.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.26%. Comparing base (6e077c6) to head (34234b7).
⚠️ Report is 10 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3415      +/-   ##
==========================================
- Coverage   78.43%   78.26%   -0.18%     
==========================================
  Files         698      699       +1     
  Lines      124594   124592       -2     
  Branches    17292    17287       -5     
==========================================
- Hits        97729    97507     -222     
- Misses      25939    26215     +276     
+ Partials      926      870      -56     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.