ci: fix release workflows for actions allowlist

[Xuanwo]

Which issue does this PR close?

None.

Rationale for this change

The v0.56.0-rc.3 tag triggered several workflow startup_failures because Apache's GitHub Actions policy blocks external actions that are not owned by GitHub, the enterprise, or explicitly allowed.

The blocked actions included Python, Node.js, .NET, Ruby, Docs, and Zig release/CI paths. These failures happen before jobs start, so rerunning the workflows cannot repair the release candidate.

What changes are included in this PR?

This PR replaces blocked third-party actions with allowed alternatives or shell commands:

• Use the already allowed pinned astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 plus uv publish for Python trusted publishing.
• Use rustup directly instead of dtolnay/rust-toolchain@stable.
• Download Zig 0.14.0 directly from ziglang.org instead of mlugg/setup-zig.
• Exchange GitHub OIDC tokens with NuGet/RubyGems directly instead of using blocked publishing credential actions.
• Use native rsync for docs nightlies deployment instead of burnett01/rsync-deployments.
• Fix release_java.yml to checkout github.ref instead of the undefined inputs.ref.

Are there any user-facing changes?

No. This only changes release and CI workflow implementation.

AI Usage Statement

AI assistance was used to investigate the workflow startup failures and prepare this release workflow fix.