ci(signed-commits): use GPG signing

[v1v]

Motivation/summary

Support signed commits using a GPG linked to the user used for the automation.

I double-checked different alternatives as explained in https://github.com/actions/runner/issues/667

But decided to use a native GitHub action for the sake of simplicity; eventually, we could use the GitHub graphql approach, but I don't know if that behaviour will change in the future. For now, I think it's safer to use the default standard approach.

Checklist

• [ ] Update CHANGELOG.asciidoc
• [ ] Documentation has been updated

For functional changes, consider:

• Is it observable through the addition of either logging or metrics?
• Is its use being published in telemetry to enable product improvement?
• Have system tests been added to avoid regression?

How to test these changes

Related issues

Part of https://github.com/elastic/apm-server/issues/12995

[mergify[bot]]

This pull request does not have a backport label. Could you fix it @v1v? 🙏 To fixup this pull request, you need to add the backport labels for the needed branches, such as:

• backport-7.17 is the label to automatically backport to the 7.17 branch.
• backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit.

NOTE: backport-skip has been added to this pull request.

[v1v]

Test

I tried these changes in a test feature-branch and

• https://github.com/elastic/apm-server/pull/13071

• https://github.com/elastic/apm-server/pull/13070