semantic-release should not commit to master

[BelfordZ]

Is your feature request related to a problem? Please describe.
At the moment, when semantic release is doing the publish step, it includes the changelog.

However, it also commits the changelog, and pushes this commit to master. Since master should be a protected branch, this presents some challenges that force us to loosen the rules, and to put powerful tokens in sketchy places.

Describe the solution you'd like
semantic-release should do everything on a release branch, opening a PR with the results instead of pushing them directly to master. This PR should be ignored by CI.

Describe alternatives you've considered
I've tried nothing and I'm all out of ideas.

Additional context
Perfection is the goal here ladies & non ladies.