Add automatic signing and uploading releases

[ppkarwasz]

This adds support for:

• [x] the verification of reproducibility of source archives.
• [x] signing of releases.
• [x] the generation of vote and announce e-mails.
• [x] the upload for releases to the staging Subversion repository

[ppkarwasz]

There are some things left to fix:

• I can not use crazy-max/ghaction-import-gpg, probably we need an INFRA ticket to install it on the repo. In the meantime I am using actions/setup-java, which is allowed to run.
• The generate-email.sh script might need some massaging.
• You might consider inlining the generate-email.sh script or run it in a different job, so the sign-and-upload does not require a Git checkout.

[swebb2066]

The instruction in the just added release instructions can be simplified. Can you include the changes in this PR. Or should I do it and add it to the branch?

I find it always useful to write instructions before writting the code.

[ppkarwasz]

@swebb2066,

Thank You for the remarks, they made me realize there is still a lot to do before we automatize all Apache Logging Services releases. I will resolve the conversations above once I have actually resolved them in this PR (i.e. don't stall the Apache Log4cxx release for this PR).

I opened a brainstorming thread on dev@logging to see how the ideal Apache Logging Services release process and release review process should look like.

[rm5248]

I don't see anything obviously wrong with what has been proposed here, we'll just have to test it out and see that it works.

[swebb2066]

don't stall the Apache Log4cxx release for this PR

The release is currently stalled anyway because logging.staged.apache.org is broken

[ppkarwasz]

don't stall the Apache Log4cxx release for this PR

The release is currently stalled anyway because logging.staged.apache.org is broken

Not anymore: https://logging.staged.apache.org/log4cxx/1.3.0/

[swebb2066]

Not anymore: https://logging.staged.apache.org/log4cxx/1.3.0/

I have commenced the release process