Fix release app token: use inputs instead of env vars

Composite actions cannot access caller's secrets context in input
defaults. Use explicit inputs with empty defaults instead. Workflows
that need branch protection bypass pass the secrets explicitly:

  release-app-id: ${{ secrets.PYBUILDER_RELEASE_APP_ID }}
  release-app-private-key: ${{ secrets.PYBUILDER_RELEASE_APP_PRIVATE_KEY }}

Author: arcivanov

action.yml

@@ -91,11 +91,11 @@ inputs:
   release-app-id:
     description: 'GitHub App ID for generating release tokens that bypass branch protection'
     required: false
-    default: ${{ secrets.PYBUILDER_RELEASE_APP_ID }}
+    default: ''
   release-app-private-key:
     description: 'GitHub App private key (PEM) for generating release tokens'
     required: false
-    default: ${{ secrets.PYBUILDER_RELEASE_APP_PRIVATE_KEY }}
+    default: ''
 outputs:
   is-release:
     description: 'true if [release] was detected in commit message'