Add a release signing job to GitLab CI

Add a GitLab CI job that is only run for tags and makes signing BIND 9 releases more convenient by utilizing a signing VM that is registered as a GitLab CI runner. This pulls the signing process into the release pipelines in GitLab CI, resulting in job artifacts containing the signatures for BIND 9 releases, which in turns simplifies the subsequent release publication steps.

See also isc-private/devops#187