Consider signing release artifacts

The OpenSSF Best Practices Badge suggests [signing release artifacts](https://www.bestpractices.dev/en/criteria). Consider using OpenEXR's [release-sign.yml](https://github.com/AcademySoftwareFoundation/openexr/blob/main/.github/workflows/release-sign.yml) workflow as a template. It's triggered on release creation and does these steps:
1. Runs `get archive` to generate a `.tar.gz` artifact
2. Signs the `.tar.gz` via [sigstore](https://www.sigstore.dev/)
3. Uploads the resulting sigstore signature file along with the tarball.

Start with OpenEXR's .github/workflows/release-sign.yml workflow, linked in the issue, and compare its release-creation trigger and archive, sigstore signing, and upload steps with OpenTimelineIO's release process. Done means a release produces the tarball, its sigstore signature, and both uploaded artifacts.

Written by the indexing model from the issue text.