FR: Publish .asc files for releases

# Feature Request

Currently, our automation uses .sha256.txt files for integrity, but these don't ensure authenticity. Signing releases would allow pipelines to verify that binaries were genuinely produced by Firecracker maintainers.

## Describe the desired solution

Provide detached .asc signatures for the release tarball or .sha256.txt manifest using the official PGP key.

## Describe possible alternatives

SHA-256 hashes, verifies download integrity but not publisher authenticity.

## Checks

- [x] Have you searched the Firecracker Issues database for similar requests?
- [x] Have you read all the existing relevant Firecracker documentation?
- [x] Have you read and understood Firecracker's core tenets?