CI: Don't sign binary artifacts on PRs from forks

[RyanGlScott]

When a pull request is submitted from a fork, it will fail when attempting to sign a binary. See here for an example:

+ sign crux-mir-0.6.0.99-ubuntu-22.04-x86_64.tar.gz
+ set +x
gpg: no valid OpenPGP data found.

This is because the OpenPGP secrets are only provided when running PRs from the main crucible repo, not from forks. To avoid this, we should skip the signing step when running a PR from a fork, much like how we do in Cryptol (see GaloisInc/cryptol#1409) and saw-script (see GaloisInc/saw-script@eedcba1 and GaloisInc/saw-script@ac082b0). This might require some slight reorganization of .github/ci.sh to decouple the signing step from the rest of zip_dist.