Maureen wants the CI process to sign images as it releases them if the signing flag is set

The tekton pipelines (https://github.com/IBM/ibm-garage-tekton-tasks) currently provide a framework for the build and publish process. The image build steps are currently separated between an intermediate version of the image and a "published" version of the image. For now, only the published version needs to be signed.

Skopeo is used to copy the image from the intermediate version/location to the published version/location. Skopeo supports signing the image as it is copied.

We can use this task as a reference - https://github.ibm.com/TAAS/image-signing-demo/blob/master/.tekton/task_build.yaml

**Acceptance criteria:**
- Provides conditional approach to opt in to signed images (this can be done through an input parameter and/or a configmap/secret attached to the task step
- Signs the image using key material provided in a secret (?)
- Documents the end to end process to run the CI process with signing (including how to generate the signing key and stor it in the secret)