Set up GPG signing of commits and tags

[chengfang]

I just created a wiki article (https://github.com/jberet/jsr352/wiki/Set-up-GPG-signing-of-commits-and-tags), outlining the steps to configure gpg signing for commits and tags. I also updated our project release document with a link to the gpg article.

Although it may seem quite some steps to configure gpg signing, it offers great benefits of verification and validation, and it grows in importance in open source development. I hope you find this article useful, and any comments are welcome.

[liweinan]

okay!

[liweinan]

Relative docs to read:

• https://wiki.debian.org/Creating%20signed%20GitHub%20releases
• https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits
• https://docs.github.com/en/repositories/releasing-projects-on-github/managing-releases-in-a-repository