This pull request adapts the GitHub Actions job generation for Maven in a way that publishing to GitHub Packages (a) is possible again and (b) roughly matches the steps required for publishing npm to Packages. To do this, I ended up changing two things:

- the permissions of the job are set correctly to `packages: write` when needed (same logic as for npm)
- the `MAVEN_USERNAME` is set to be the GitHub Actor automatically if no override was given, like shown in the GitHub docs

To do the latter I introduced a concept of `expressions` to the `PublishJobOptions`, which allow more freedom than the secrets option, but use the same logic. I also converted the secrets implementation to use these expressions under the hood, so they are essentially a shortcut for an expression now.

Jobs that publish to Maven Central or other repositories will be generated in the same way still, however the `MAVEN_USERNAME` env variable moved spots (hence the change in release.yml).

I tested it in a private project and can confirm that it works now, see below for an excerpt from my test config and the result as a screenshot.

```typescript
const project = new AwsCdkConstructLibrary({
  publishToMaven: {
    javaPackage: 'com.github.mkerix.projenmaventest',
    mavenArtifactId: 'projen-maven-test',
    mavenGroupId: 'com.github.mkerix',
    mavenServerId: 'github',
    mavenRepositoryUrl: 'https://maven.pkg.github.com/mKeRix/projen-maven-test',
    mavenPassword: 'GITHUB_TOKEN',
  },
});
```

![Bildschirmfoto 2021-07-25 um 15 23 12](https://user-images.githubusercontent.com/770596/126900642-c5232aed-64f8-4835-a33b-0a791cff2add.png)

Closes projen#947.