Supply chain security: Publish Sigstore signatures for release artifacts

Binary release artifacts for this project are currently unsigned, which leaves a risk to supply chain security.

Publishing Sigstore signatures alongside each artifact is an easy way to provide cryptographic proof of provenance, i.e. the build was performed in GitHub Actions from specific source code.

As far as I know, the GitHub Action for this needs no additional set-up: https://github.com/sigstore/gh-action-sigstore-python

Projects like CPython have adopted this practice; it would be a strong step toward securing the integrity of Codex releases.