feat(NODE-6156): add signature to github releases

[aditi-khare-mongoDB]

Description

Sign releases in both 5.x and 6.x

What is changing?

Automate release signing with a detached signature and verification instructions in the README.
Example Signature Link: https://github.com/mongodb/js-bson/actions/runs/9195659055

Is there new documentation needed for these changes?

No

What is the motivation for this change?

SSDLC Compliance

Release Highlight

Add Signature to Github Releases

The Github release for js-bson now contains a detached signature file for the NPM package (named
bson-X.Y.Z.tgz.sig), on every major and patch release to 6.x and 5.x. To verify the signature, follow the instructions in the 'Release Integrity' section of the README.md file.

Double check the following

• Ran npm run check:lint script
• Self-review completed using the steps outlined here
• PR title follows the correct format: type(NODE-xxxx)[!]: description
  • Example: feat(NODE-1234)!: rewriting everything in coffeescript
• Changes are covered by tests
• New TODOs have a related JIRA ticket

[baileympearson]

Nice work!

One other note - Looks like only the release tarball (no signature file) is upload: https://github.com/mongodb/js-bson/actions/runs/9195659055

[aditi-khare-mongoDB]

@baileympearson If you click on the bson-6.6.0.tar.gz file, it contains a bson-6.6.0.tar.gz.sig file within

[baileympearson]

@aditi-khare-mongoDB Oh, you're right! Nice.

Is is possible to upload them separately? I don't know if it matters much, but I think we should shoot for something similar to what devtools has for their repos, where the signatures are attached separate from the file. Here's an example: https://github.com/mongodb-js/compass/releases/tag/v1.43.0

[nbbeeken]

Jumping in here, yeah I also expected the .sig to be a "top-level" artifact and that the only tgz would be the one that can be obtained from npm. Not that there is something wrong with a tgz on our GH releases it just isn't the tgz users are likely to ingest. The following command:

npm view bson@latest dist.tarball

When automating this, I'll want to replace "latest" with something like npm ls bson and grab "my" version.

With that, I can get the tar url, a bit of curl here, and a bit of gpg there ✨ and you've got a validated signature. I am also thinking that the tgz we upload to npm gets replicated to artifactory instances so again the tgz on GH isn't the tgz folks care about.

[nbbeeken]

Please add release highlights, otherwise LGTM