ci(github-workflows): fix release workflow, signed assets

[tomassebestik]

Description

This PR fixes the failing release action in the GitHub workflow, e.g.: https://github.com/espressif/cz-plugin-espressif/actions/runs/11143519291/job/30968812509.

• Now follows the practices suggested by Publishing package distribution releases using GitHub Actions CI/CD workflows.
• The strategy of the create-release workflow has changed:
  • Was: Multiple Python build jobs ---> merge artifacts (merging often corrupted the .gz archive).
  • Is: One build job builds a universal Python 3 wheel (-py3-none-any.whl) + source code ---> testing this build in a matrix (os/python/arch); this is faster, avoids issues with overwriting artifacts, and allows for caching.
• Set Trusted Publishing on PyPI and TestPyPI—no tokens required.
• Distribution packages (*.whl / *.tar.gz) are automatically signed with Sigstore before upload to GitHub release
• All actions in the workflow have been updated to the latest fixed release.

Tested on fork (will not be merged; contains the same changes as this PR)

• Full pipeline triggered by pushing a tag: https://github.com/tomassebestik/cz-plugin-espressif/actions/runs/11213710768.
  (trigger: from master by cz bump --retry ---> git push --force-with-lease ---> git push origin --tags )

• GitHub release details, with assets and automatic release notes: https://github.com/tomassebestik/cz-plugin-espressif/releases/tag/v1.4.0.

• Test-PyPI release: https://test.pypi.org/manage/project/czespressif/release/1.4.0/.

• Test-PyPI release: didn't run, but expected to works the same as TestPYPI

Note

On the fork, v1.3.0 and v1.4.0 were created by fake commits within testing and have nothing to do with versioning in espressif/cz-plugin-espressif (this repo).

[tomassebestik]

FYI @radimkarnis @peterdragun

[github-actions]

	Messages
📖	🎉 Good Job! All checks are passing!

👋 Hello tomassebestik, we appreciate your contribution to this project!

---

📘 Please review the project's Contributions Guide for key guidelines on code, documentation, testing, and more.

---

Click to see more instructions ...

This automated output is generated by the PR linter DangerJS, which checks if your Pull Request meets the project's requirements and helps you fix potential issues.

DangerJS is triggered with each push event to a Pull Request and modify the contents of this comment.

Please consider the following:
- Danger mainly focuses on the PR structure and formatting and can't understand the meaning behind your code or changes.
- Danger is not a substitute for human code reviews; it's still important to request a code review from your colleagues.
- To manually retry these Danger checks, please navigate to the Actions tab and re-run last Danger workflow.

Review and merge process you can expect ...

We do welcome contributions in the form of bug reports, feature requests and pull requests.

1. An internal issue has been created for the PR, we assign it to the relevant engineer.
2. They review the PR and either approve it or ask you for changes or clarifications.
3. Once the GitHub PR is approved we do the final review, collect approvals from core owners and make sure all the automated tests are passing.
- At this point we may do some adjustments to the proposed change, or extend it by adding tests or documentation.
4. If the change is approved and passes the tests it is merged into the default branch.

Generated by 🚫 dangerJS against 3cd1e18

[tomassebestik]

@hfudev PTAL .... when this merged, we can do release to v1.3.0, also with your #15.
Thanks!

[hfudev]

LGTM!