Publishing from CI

A separate publish key allows a release to be pushed straight to the hub over the API, so a build pipeline can ship without anybody opening wp-admin.

It is a different credential from the product key and the site tokens, and it only permits publishing.