update wheel builder with manylinux, musllinux, and macOS universal2

[reaperhulk]

Switches to building sdist from tagged checkout and building the wheel from that as well.

Example run: https://github.com/pyca/pynacl/actions/runs/1618808275

This PR also alters the release script to upload the sdist after wheels are built to limit the window of sdist only.