ci: automated release builds

Includes PR #318 to enable aarch64 macOS builds. This enables CI runs when pushing a tag. It also adds a new release job that only runs on tag pushes, and will create a draft release on the repository and attach binaries and their sigstore signatures.

Downloaded files from the release can then be verified with sigstore as follows:

% RELEASE_TAG=v1.2.3
% FILE=medusa-linux-x64.tar.gz
% sigstore verify github \
  --bundle "${FILE}.sigstore" \
  --cert-identity "https://github.com/crytic/medusa/.github/workflows/ci.yml@refs/tags/$RELEASE_TAG" \
  "$FILE"

crytic / medusa

ci: automated release builds #342