gha: Add diff and deploy

[vvoland]

Add scripts that will be used by https://github.com/docker/docker-install-deploy to deploy the script.

[thaJeztah]

Thanks! Curious if there's be ways to keep anything "deploy" to internal repositories (without it being cumbersome); mostly trying to avoid public repositories having access to secrets, but not sure if there's a good way. Would it be possible to have an internal flow subscribe to merges (e.g.)? Maybe @crazy-max has fancy ideas.

(That's not a "no", just "are there options for this?", as these secrets might give access to critical bits).

[vvoland]

Only the ID of the S3 buckets and the cloudfront distribution IDs are stored as repo secrets, but these aren't really sensitive, it's more of a security-by-obscurity.

The actual AWS credentials are obtained dynamically via OIDC and they're only accessible from the master branch alone.

We could make merge notify an internal repo and run the workflow there if we really want. Not sure if we really need though.

[742764146]

这是一封自动回复邮件。已经收到您的来信，我会尽快回复。 translation: "This is an automatic reply email. I have received your letter, and I will reply as soon as possible." 😅

[vvoland]

Ok, fine, let's move it to internal 😅

[thaJeztah]

assuming kevin reviewed 😂

'LGTM"