Document the Github CI setup

[jku]

• document how to run snapshot & timestamp on github
• especially document the gotchas and security issues with this
• research/experiment with actions: could the workflows be defined in this repo, so the metadata repo could just use them? The docs recommend putting each action in it's own repo but there is a "uses" format that seems like it would allow using actions from just another github repo: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#example-using-a-public-action-in-a-subdirectory, uses: owner/repo/path/to/action@git-commitish (alternatively could checkout the repo, then use it as local action)