Move Maven local release signing to its own workflow

[twyatt]

This will allow CI to pass for PRs from forks (as demonstrated by this PR coming from my fork).

These changes make it so that release signing isn't validated until after merges to main, but I think issues with release signing should be rare.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 79.74%. Comparing base (14f6646) to head (d78d2fc).
Report is 22 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff              @@
##               main     #343      +/-   ##
============================================
+ Coverage     79.10%   79.74%   +0.63%     
  Complexity       90       90              
============================================
  Files            25       25              
  Lines          1254     1165      -89     
  Branches        124      124              
============================================
- Hits            992      929      -63     
+ Misses          203      177      -26     
  Partials         59       59              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.