Figure out how to sign for the default release assets

[woodruffw]

By default, GitHub Actions produces {tag}.tar.gz and {tag}.zip assets for each release.

These artifacts are generated on the fly, meaning that they can (and have) changed their contents (and thus digests) over time. This recently caused some significant breakage due to incorrect assumptions around that: https://github.blog/changelog/2023-01-30-git-archive-checksums-may-change/

Given that they can change, the correct thing for us to do here is probably to download the asset as it appears, sign for it, and then re-upload it to the release as a new asset: this will freeze it, meaning that the signature will remain correct.

[woodruffw]

So, the individual items here:

1. Figure out how to download the "special" {tag}.tar.gz and {tag}.zip assets from a workflow that was triggered by the release: published event;
2. Sign for them;
3. Upload them back to the release, along with their signatures.

[woodruffw]

CC @tnytown: I can't assign you this since you're not an org member, but this is a good first issue to start with.