Consider moving official build signing out of the main build pipeline

[dagood]

We can move signing out of the main build pipeline into an independent pipeline.

• The main build pipeline could complete whether or not signing has finished yet, for more throughput regardless of signing infra speed/state.
• If the signing infrastructure needs to change, it can be updated in one infra branch that applies to all Go branches.
  • A "floating" dependency like this is a red flag. It can cause unanticipated build breaks, and makes it hard to resurrect an old branch if the floating branch has had breaking changes since the last successful build.
  • This might be ok to float, because the set of artifacts seems like it will be relatively simple and stable over time.
  • If we need to update the version of signing tooling, it could be tedious to cherry-pick the change to each branch. updating just one branch is a way to avoid that. Another way would be to figure out how to set up auto-updates for these versions.