SITES-49657 - Release CIF components 2.18.6

 * map MAVEN_CENTRAL_USERNAME / MAVEN_CENTRAL_PASSWORD into the release job env, so the
   settings.xml placeholders for the Sonatype Central Portal server resolve instead of
   being sent literally, which made the central-publishing plugin fail with HTTP 401
 * document the two secrets in the workflow header

Author: LSantha

.github/workflows/release.yml

@@ -7,6 +7,7 @@
 #
 # Required secrets:
 #   ARTIFACTORY_CLOUD_USER, ARTIFACTORY_CLOUD_PASS  - Adobe Artifactory (.github/scripts/settings.xml)
+#   MAVEN_CENTRAL_USERNAME, MAVEN_CENTRAL_PASSWORD  - Sonatype Central Portal (.github/scripts/settings.xml)
 #   NPM_TOKEN                                        - npm publish
 #   GPG_PRIVATE_KEY, GPG_PASSPHRASE                  - artifact signing
 #   DEPLOY_QUERIES_SSH_KEY                            - deploy key with push access to
@@ -79,6 +80,8 @@ jobs:
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
           ARTIFACTORY_CLOUD_USER: ${{ secrets.ARTIFACTORY_CLOUD_USER }}
           ARTIFACTORY_CLOUD_PASS: ${{ secrets.ARTIFACTORY_CLOUD_PASS }}
+          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
+          MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
 
       - name: Clean up secrets
         if: always()