Use env-vars for passing secrets used during release

[sebersole]

Currently HR (and ORM) use Project properties for passing secrets used during release (OSSRH, signing, etc). This is a security concern; we should use env-vars instead.

[DavideD]

Merged in all the relevant branches: main, wip/*, and 2.4