Workflow to copy artifacts between workspaces

MUST: Implement a workflow step that enables copying/moving of one or more artifacts from the current workspace to a target workspace

• The idea is to push from a private workspace to a public one

To achieve the desired goals, this probably needs to extend beyond just artifacts across workspaces, and copy source + binary artifacts from one debian:suite to another (across workspaces).

Implementation plan based on design in !1189 (merged):

• Add support for lookup__KEY in dictionary lookups (!1277 (merged))
• Add same_work_request lookup filter to debian:package-build-logs collection (!1277 (merged))
• Add Workspace.file_stores (!1285 (merged))
• Simplify CollectionItem.expand_variables (!1289 (merged))
• Add CopyCollectionItems task (!1296 (merged))
• Add package_publish workflow

If enough work on the permissions system has been done to allow this, then add appropriate permission checks too. Otherwise, leave a to-do comment and file a separate issue for that.

I've also added a checklist item to #510 (closed) for the debusine:task-history part of this, since that work is scheduled for M5 and so will presumably happen after the rest of this issue.