Add sigstore oncall group to root-signing

[haydentherapper]

With push permissions, this will let oncall members trigger workflows in the event that metadata needs to be manually synced.

Summary

Release Note

Documentation

[github-actions]

🍹 preview on sigstore-github-sync/sigstore/github-prod

Pulumi report

Previewing update (sigstore/github-prod)

View Live: https://app.pulumi.com/sigstore/sigstore-github-sync/github-prod/previews/c6cd63f1-f1e8-4b24-ba72-1d0fd488ee38

@ Previewing update.....
pulumi:pulumi:Stack: (same)
[urn=urn:pulumi:github-prod::sigstore-github-sync::pulumi:pulumi:Stack::sigstore-github-sync-github-prod]
@ Previewing update....
+ github:index/teamRepository:TeamRepository: (create)
    [urn=urn:pulumi:github-prod::sigstore-github-sync::github:index/teamRepository:TeamRepository::root-signing-sigstore-oncall]
    permission: "push"
    repository: "root-signing"
    teamId    : "6693572"
Resources:
+ 1 to create
580 unchanged