Support for signed source releases

Several ASWF projects have implemented signed source releases. For instance in OpenEXR:

https://github.com/AcademySoftwareFoundation/openexr/blob/main/.github/workflows/release-sign.yml

This has a few advantages:

- immutable source release, even if the release tag gets modified after the fact
- visible SHA-256 checksum for the tarball
- ability to programmatically verify authenticity of the tarball

Unfortunately there doesn't seem to be a way to prevent the automatically generated links for unsigned .tar.gz and .zip archives from showing up.

Start by reviewing OpenEXR’s .github/workflows/release-sign.yml, then inspect OpenRV’s existing release workflow and GitHub’s generated source archive behavior. Determine how signed archives and SHA-256 checksums can be published while addressing the automatically generated unsigned links; done means the release process documents and produces verifiable signed source artifacts.

Written by the indexing model from the issue text.