Consider signing release artifacts

The OpenSSF Best Practices Badge suggests [signing release artifacts](https://www.bestpractices.dev/en/criteria). Consider using OpenEXR's [release-sign.yml](https://github.com/AcademySoftwareFoundation/openexr/blob/main/.github/workflows/release-sign.yml) workflow as a template. It's triggered on release creation and does these steps:
1. Runs `get archive` to generate a `.tar.gz` artifact
2. Signs the `.tar.gz` via [sigstore](https://www.sigstore.dev/)
3. Uploads the resulting sigstore signature file along with the tarball.

It looks like your release process already involves generating explicit tarballs, so your signing workflow won't need that step, but it will need to run sigstore on each of the artifacts.

Start by inspecting OpenCue's existing release workflow and artifact generation, then compare them with OpenEXR's .github/workflows/release-sign.yml template. The workflow should run sigstore for each already-generated release artifact and upload each signature alongside its artifact when a release is created.

Written by the indexing model from the issue text.