Issue #156 fix Central publish 401 in release workflow

actions/setup-java's server-username/server-password/gpg-passphrase
inputs take environment variable NAMES, not secret values. Passing the
values directly left settings.xml with empty credentials, so the
Sonatype Central upload failed with 401 on every release tag since
0.1.8. Provide the values via the step env block and reference the
names instead.

Author: simbo1905

.github/workflows/release-on-tag.yml

@@ -30,10 +30,16 @@ jobs:
           java-version: '21'
           cache: maven
           server-id: central
-          server-username: ${{ secrets.CENTRAL_USERNAME }}
-          server-password: ${{ secrets.CENTRAL_PASSWORD }}
+          # setup-java expects ENVIRONMENT VARIABLE NAMES here, not values;
+          # the values are provided via the env block below (issue #156).
+          server-username: CENTRAL_USERNAME
+          server-password: CENTRAL_PASSWORD
           gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
-          gpg-passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          gpg-passphrase: GPG_PASSPHRASE
+        env:
+          CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
+          CENTRAL_PASSWORD: ${{ secrets.CENTRAL_PASSWORD }}
+          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
       - name: Extract version from tag
         id: version