ci(updater): sign artifacts and consolidate updater manifest

Adds TAURI_SIGNING_PRIVATE_KEY(_PASSWORD) env to release-linux,
release-linux-aarch64, and release-macos build steps, collects the
resulting .sig files into the release artifacts, and adds a new
release-updater-manifest workflow that waits for all platform sig
files to land on the release and assembles latest.json for the
updater endpoint.

Cherry-picked from #305 by @afonsojramos.

cc

.github/workflows/release-linux-aarch64.yml

@@ -71,6 +71,9 @@ jobs:
         run: npm run build
 
       - name: Build Tauri (deb + rpm + appimage)
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
         run: npm run tauri build -- --bundles deb,rpm,appimage
 
       - name: Collect artifacts
@@ -81,6 +84,7 @@ jobs:
           cp -v src-tauri/target/release/bundle/deb/*.deb dist/ || true
           cp -v src-tauri/target/release/bundle/rpm/*.rpm dist/ || true
           cp -v src-tauri/target/release/bundle/appimage/*.AppImage dist/ || true
+          cp -v src-tauri/target/release/bundle/appimage/*.AppImage.sig dist/ || true
 
           # Create AUR tarball
           ARCH=aarch64