Add minisign signature verification for cargo binstall to prevent supply chain attacks

## Feature Request

Currently, the Dioxus CLI installation docs recommend `cargo binstall dioxus-cli --force`, which downloads a prebuilt binary. However, there's no guidance on verifying the integrity of the downloaded binary.

`cargo-binstall` supports **signature verification** via minisign. When a crate's `Cargo.toml` includes a `[package.metadata.binstall.signing]` section with a public key, binstall will automatically download the `.sig` file alongside the binary and verify it before installing.

This would give users a safer install path — especially important since `dioxus-cli` is a build tool that executes arbitrary code on the user's machine.

Additionally, `cargo binstall` supports an `--only-signed` flag that lets security-conscious users refuse to install any package that doesn't come with a valid signature. Without signing metadata in `dioxus-cli`, this flag effectively blocks installation.

## Implement Suggestion

1. **Generate a minisign keypair** for release signing:
```
minisign -G -W -p signing.pub -s signing.key
```

2. **Add signing metadata** to `dioxus-cli`'s `Cargo.toml`:
```toml
[package.metadata.binstall.signing]
algorithm = "minisign"
pubkey = ""
```

3. **Sign release artifacts** in CI (GitHub Actions release workflow):
```
minisign -S -W -s signing.key -x .sig -m
```
Upload both the artifact and its `.sig` file as release assets.

4. **Consider just-in-time (keyless) signing** to avoid storing a long-lived private key. `cargo-binstall` itself uses this approach in its own release workflow — an ephemeral keypair is generated per release, the public key is written to `Cargo.toml` before publishing, and the private key is discarded. See [[cargo-binstall's release.yml](https://github.com/cargo-bins/cargo-binstall/blob/main/.github/workflows/release.yml)](https://github.com/cargo-bins/cargo-binstall/blob/main/.github/workflows/release.yml) for a reference implementation.

5. **Update install docs** to recommend:
```
cargo binstall dioxus-cli --only-signed
```

This aligns with the broader Rust ecosystem's push toward supply chain security and lets users who enforce `--only-signed` policies install `dioxus-cli` without exceptions.

## References

- [[cargo-binstall signing documentation](https://github.com/cargo-bins/cargo-binstall/blob/main/SIGNING.md)](https://github.com/cargo-bins/cargo-binstall/blob/main/SIGNING.md)
- [[cargo-binstall's own release workflow (just-in-time signing example)](https://github.com/cargo-bins/cargo-binstall/blob/main/.github/workflows/release.yml)](https://github.com/cargo-bins/cargo-binstall/blob/main/.github/workflows/release.yml)