Cryptograhpically Sign releases

### Current Behavior

Currently it is not possible to verify the authenticity or cryptographic integrity of the [downloads from flarum.org](https://docs.flarum.org/install/#installing-by-unpacking-an-archive) or github.com because the releases are not cryptographically signed.

This makes it hard for flarum users to safely obtain the flarum software, and it introduces them (and potentially their user's data) to watering hole attacks.

### Steps to Reproduce

1. Go to the flarum.org
2. Click `Download Now`
5. ???

### Expected Behavior

A few things are expected:

1. I should be able to download the flarum PGP key out-of-band from popular third-party keyservers (eg https://keys.openpgp.org/)
2. I should be able to download a cryptographic signature of the release (or, better, the releases' digest file, such as a `SHA256SUMS.asc` file) along with the release itself
3. The downloads page itself should include a link to the documentation page that describes how to do the above two steps

### Screenshots

_No response_

### Environment

Everything, all versions. Extensions too.

### Output of `php flarum info`

```
Output of "php flarum info", run this in terminal in your Flarum directory.
```

### Possible Solution

See "Expected Behaviour" Section

### Additional Context

_No response_