Update GPG documentation

As the GPG documentation on this plugin's README is getting a bit old, does not mention a good GitHub Actions solution, and is a bit confusing, it would benefit from being refreshed.

Worth mentioning that if we progress towards getting https://github.com/semantic-release/semantic-release/pull/1871 merged, it would be worth moving the GPG instructions directly into the web documentation (maybe even preemptively).

Things that could/should be included in the future documentation:

• crazy-max/ghaction-import-gpg as discussed in #438.
• to meet the "require verified commits" branch protection requirement, the documentation suggests adding the generated GPG key to the account owning the GitHub token used for release, which is hazardous, given a user with push access to the repository could then retrieve it and use it to impersonate you. That approach would be secure only if using a dedicated bot account (ideally per repository).
• the issue above would not apply to signing tags, because the branch protection rule does not apply to them

Start with the GPG section of the plugin README and review the discussion in #438, then check the possible move to web documentation referenced by semantic-release/semantic-release#1871. Update the documentation with the GitHub Actions option, the warning about using a release account for verified commits, and the distinction between commit and tag signing.