github-release: support checksum signature

[XaF]

As a follow-up to #539, we should try and find a way to support signature verification for github releases. A number of releases provide signatures of the checksums, for instance using minisign or other systems. We should investigate how complex it would be to support that in omni directly, maybe with a sig: configuration for the release.