feat(NODE-6157): add signature to github releases

[aditi-khare-mongoDB]

Description

Sign releases in both 5.x and 6.x

What is changing?

Automate release signing with a detached signature and verification instructions in the README.
Link to an example of release signatures working with v2 (if you check the artifact link at the end of the compress_sign step, you can see the signature)

Is there new documentation needed for these changes?

No

What is the motivation for this change?

SSDLC Compliance

Release Highlight

Add Signature to Github Releases

The Github release for the mongodb package now contains a detached signature file for the NPM package (named
mongodb-X.Y.Z.tgz.sig), on every major and patch release to 6.x and 5.x. To verify the signature, follow the instructions in the 'Release Integrity' section of the README.md file.

Double check the following

• Ran npm run check:lint script
• Self-review completed using the steps outlined here
• PR title follows the correct format: type(NODE-xxxx)[!]: description
  • Example: feat(NODE-1234)!: rewriting everything in coffeescript
• Changes are covered by tests
• New TODOs have a related JIRA ticket

outdated, pending other fixes

[baileympearson]

Do we have an example of a successful signing using the gpg-sign v2 action? Either here or from js-bson would be fine since I assume the scripts are almost identical.

[aditi-khare-mongoDB]

@baileympearson Just added a link to an example in the PR description!