fix(build): explicitly add --nosign when building a srcpkg

We should explicitly instruct makepkg to not sign the source package, even when the BUILDENV array in makepkg.conf contains 'sign'. The devtools workflow is to always sign separately from building, which is different from makepkg and it should not depend on its configuration.

Furthermore, this function is currently used only in offload-build to collect sources that are transferred to the server before the build itself. Signing this source package does not provide any benefits.