feat(beetmover): add linuxfirefoxcom and linuxfirefoxcom-stage GCS resources

[JohanLorenzo]

Summary

• Adds two new GCS resources to beetmoverscript so it can publish install-firefox.sh (+ detached .asc) to the bucket backing linux.firefox.com:
  • linuxfirefoxcom-stage (try only — deliberately not on autoland, since autoland shares gecko-3-beetmover with real release publishing)
  • linuxfirefoxcom (prod, mozilla-central only)
• Both use direct-push-to-bucket; no apt/yum repos.
• Adds .sh to MIME_MAP (currently defaults to application/x-sh via Python's stdlib, which would make a browser download the file instead of rendering it).
• linuxfirefoxcom-stage only exists in the (dev|fake-prod) worker.yml branch — try resolves to gecko-1-beetmover there, and nothing running on gecko-3-beetmover (the prod branch) should ever request it.

Merge order

1. mozilla/webservices-infra#12383 — creates the buckets + linuxfirefoxcom_beetmover SA
2. mozilla-services/cloudops-infra#6998 — plumbs the two GCS_LINUXFIREFOXCOM*_CREDS secrets into the beetmover helm chart
3. This PR — needs the real secret values loaded by CloudOps before merging, or init_worker.sh's test_var_set will crash-loop the worker
4. fxci-config grants (bug 2069357) + firefox taskgraph kinds (bugs 2069358, 2069360)

Bug: 2069356, blocking bug 1926556. Tracked in SREIN-1757.

Verification

• uv run --with tox tox -e py314 — 233 passed
• uv run --with tox tox -e init-py314 (repo-wide init.sh test) — 264 passed
• Push to dev-beetmoverscript, confirm gecko-1-beetmover-dev rolls out clean (no is not set errors)