Improve _update_bundle.yaml to sign commits for newly created PRs

Hi,

We have recently enabled canonical repo automation on all Data repos and it enforced requirements for the signed commits.
At the moment the update-bundle workflow doesn't not sign commit. It is a issue to add such possubility:

STR:
Create a new PR using [_update_bundle.yaml](canonical/data-platform-workflows/.github/workflows/_update_bundle.yaml)

AR:
https://github.com/canonical/postgresql-k8s-bundle/pull/509 cannot be merged due to `Commits must have verified signatures
`.

ER:
Newly created PR has all commits signed by Canonical GH bot SSH key.

Open .github/workflows/_update_bundle.yaml and follow the stated steps to create a test PR. Compare its commits with the failure reported in canonical/postgresql-k8s-bundle#509. Done means newly created PR commits are signed and show verified signatures from the Canonical GH bot SSH key.

Written by the indexing model from the issue text.