ci: Add gpg signature to checksum file.

[winder]

Summary

Sign checksum file as part of publishing a release.

The approach here follows a suggestion in the goreleaser docs where the signature is limited to the checksum file.

References:

• goreleaser docs: https://goreleaser.com/customization/sign/
• ghaction-import-gpg docs: https://github.com/crazy-max/ghaction-import-gpg

Repository configuration requires adding the GPG secret and passphrase.

Test Plan

Tested the configuration in a private repo:
https://github.com/algorand/goreleaser-test/releases/tag/untagged-e548c44def7b11988fec

[codecov]

Codecov Report

Merging #150 (5bddcad) into master (442791a) will increase coverage by 5.23%.
Report is 60 commits behind head on master.
The diff coverage is 82.80%.

@@            Coverage Diff             @@
##           master     #150      +/-   ##
==========================================
+ Coverage   67.66%   72.89%   +5.23%     
==========================================
  Files          32       38       +6     
  Lines        1976     2789     +813     
==========================================
+ Hits         1337     2033     +696     
- Misses        570      646      +76     
- Partials       69      110      +41     

Files Changed	Coverage Δ
conduit/data/block_export_data.go	100.00% <ø> (+92.30%)	⬆️
conduit/metrics/metrics.go	100.00% <ø> (ø)
conduit/pipeline/metadata.go	73.52% <ø> (+4.41%)	⬆️
conduit/plugins/config.go	100.00% <ø> (ø)
conduit/plugins/importers/algod/metrics.go	100.00% <ø> (ø)
...gins/processors/filterprocessor/fields/searcher.go	77.50% <ø> (ø)
...ins/processors/filterprocessor/filter_processor.go	83.82% <ø> (+3.54%)	⬆️
...plugins/processors/filterprocessor/gen/generate.go	34.28% <ø> (ø)
conduit/plugins/processors/noop/noop_processor.go	64.70% <ø> (+6.81%)	⬆️
pkg/cli/internal/list/list.go	20.75% <ø> (ø)
... and 22 more

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[onetechnical]

This looks fine for now, though we may want to modify this to do detached sigs as well.