Make nightlies signed

[lidel]

Right now we only sign releases (#367), but we could sign every nighly dist by reusing scripts/ci/sign-new-macos-releases.sh. The challenge is to figure out how to do multi-stage build based on dynamically assembled matrix of jobs in prepare-matrix stage.

Signed artifacts could then be attached to the nightly build summary, if anyone wants to test them.