Build keyring material on tag and add as release

To make downstream packaging easier for other distributions (e.g. Debian), we need to build the keyring and attach it to a release, when a tag is created.

This way downstreams do not have to rely on using keyringctl (which can be an issue due to e.g. the sq version in use) to generate the keyring file.