chore(release): sign GitHub release artifacts with gpg

[jericht]

What was the problem/requirement? (What/Why)

We need to sign our GitHub release artifacts with gpg so that users can verify their downloads

What was the solution? (How)

Sign our GitHub release artifacts with gpg in our Release: Publish workflow and distribute the PGP signature files on the GitHub release page

What is the impact of this change?

Users can verify their downloads using our PGP signature files and public key

How was this change tested?

Verified this is working on my test repository (ping me for access if you don't have it)

• https://github.com/jericht/GitHubWorkflowPlayground/compare/3e5ec08cef9c962e8b0ebd5f4a6be84fcdbab0ec...6007ae76da1abcea5a356d2657c813a7b9de080e
• https://github.com/jericht/GitHubWorkflowPlayground/actions/runs/7859081504/job/21444784159
• https://github.com/jericht/GitHubWorkflowPlayground/releases/tag/0.3.0

Verified changing to printenv is working:

• https://github.com/jericht/GitHubWorkflowPlayground/actions/runs/7876309027/job/21490055464

PRE-MERGE CHECKLIST

• [x] The AWS_PGP_KEY_SECRET_ROLE secret has been added to the release environment
• [x] The AWS_PGP_KEY_SECRET secret has been added to the release environment
• [x] Add mainline as a branch allowed to use release environment

Was this change documented?

No

Is this a breaking change?

No

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.