Sign layer using AWS Signer before publishing

[nhinsch]

What does this PR do?

• Add a sign_layers script which uploads built layers to S3, uses AWS Signer to sign them, and then downloads the signed layers back to the developer's machine, replacing the unsigned layers.
• Replace the publish_staging script with publish_sandbox, and publish to the sa-east-1 region to reflect our current practices.
• Update the publish_sandbox and publish_prod scripts to call sign_layers before publish_layers.

Bonus:

• Swap out the actions/setup-ruby GitHub action in favor of ruby/setup-ruby. The old action was flaking and apparently it's on it's way to being deprecated.

Motivation

We want to support the new Code Signing for Lambda feature. This will allow customers to use the layer with functions that are configured to require signed code.

Testing Guidelines

Tested in the sandbox account.

Types of Changes

• Bug fix
• New feature
• Breaking change
• Misc (docs, refactoring, dependency upgrade, etc.)

Check all that apply

• This PR's description is comprehensive
• This PR contains breaking changes that are documented in the description
• This PR introduces new APIs or parameters that are documented and unlikely to change in the foreseeable future
• This PR impacts documentation, and it has been updated (or a ticket has been logged)
• This PR's changes are covered by the automated tests
• This PR collects user input/sensitive content into Datadog
• This PR passes the integration tests (ask a Datadog member to run the tests)

[DarcyRaynerDD]

LGTM