Allow releasing unsigned packages into community project repositories

Currently, we can't release an unsigned package into a product. For community products, we'd need to allow community product owners to do so (at their own risk).

* This involves adding a "requires sign" option to the product which, upon release, overrides the "need to sign" requirement, if marked as such
* This toggle can be updated by superusers and product managers only