Switch should_sign to an output and add signing data

[LaurentGoderre]

This serves multiple purpose. Using output instead of environment allows using the data in subsequence jobs as well as steps making it more flexible. The PR also gets the data necessary for signing from the builds.json so the file isn't needed in subsequent jobs.

[whalelines]

LGTM

[LaurentGoderre]

@tianon this is ready to go

[yosifkit]

Is there a way to add more to this so that it is all the workflow logic changes (jobs, steps, outputs, artifacts?, etc) but still without the signing changes? Right now, this PR feels like a producer without a consumer or an unused function; it removes the necessary permission while adding variables and an output that aren't used. (one output is used as it replaces a previous env var). And I'd rather that we keep a complete workflow where all things are used.

So, I think this PR should also have the Sign steps in their own job (one job with multiple steps or multiple jobs 🤷) so that we can have a complete change that exercises the GITHUB_ENV as well as the new GITHUB_OUTPUT. And, I guess, the changes to have the Sign and Push jobs consume the image as an artifact. Maybe that's somewhere between this and #41?

[whalelines]

All the changes are in place and shown to be working in the test repo, right? The idea was to provide multiple smaller PRs so things are easier to review. If you want to see them all together you can look in the testing repo.