ci: update Buildkite pipeline for GitHub CLI migration (#2602)

Purpose
This PR updates the .buildkite/pipeline.yml configuration to support the
migration of our release scripts to the official GitHub CLI (gh).

Key Changes
Tool Provisioning: The legacy ubuntu1804-java11 release image does not
have gh pre-installed. Added a step to securely install gh via the
official apt repository before the release script executes.

Script Patching: The previous pipeline used sed -i -e '403,410d' to
remove the GPG signing loop from build.sh. Because the release script
has been refactored, those line numbers are no longer accurate. This PR
updates the sed command to use content-based pattern matching (/rm
-f.*sha256/,/done/d), making it immune to future line-number shifts.

Variable Escaping: Ensured all Bash variables (\${ARTIFACTS},
\${keyfile}) are properly escaped so they are evaluated at runtime
inside the Docker container, not interpolated by Buildkite on the host.

Verification
[x] Verified gh installation commands for Ubuntu 18.04.

[x] Confirmed sed regex accurately targets the correct code block in
build.sh.

[29452](https://github.com/bazelbuild/bazel/pull/29452) - Github CLI
migration for release