build: signed PGXN release tooling + Drone pipeline

Build the distribution from src/ (control, versioned SQL, META, MIT LICENSE,
PGXS Makefile, install README), checksum it, and sign an Ed25519 JWT manifest
(audience pgmorbac-release) with the verification public key attached to the
release. `npm run release` does it locally; the Drone pipeline does it on a
v* tag once the repo is Trusted with the pgmorbac_release_key + gitea_token
secrets.

.gitignore

@@ -15,4 +15,8 @@ Thumbs.db
 *.swo
 *~
 .vscode/
-.idea/
+.idea/
+# Release tooling
+node_modules/
+dist/
+package-lock.json