Consider signing release artifacts

[cary-ilm]

The OpenSSF Best Practices Badge suggests signing release artifacts, using OpenEXR's release-sign.yml workflow as a template. It's triggered on release creation and does these steps:

1. Runs get archive to generate a <release>.tar.gz artifact
2. Signs the <release>.tar.gz via sigstore
3. Uploads the resulting sigstore signature file along with the tarball.