Debsign

# Debsign task

This is a signing task that signs a debian:upload artifact on a signing worker. It is separate from the Sign task because signing uploads is a customized operation involving signing multiple files and possibly updating checksums in the `.changes` file to match the signed versions of other files.

The `task_data` for this task may contain the following keys:

- `unsigned` (Single lookup, required): the debian:upload artifact whose contents should be signed

- `key` (string, required): the fingerprint of the debusine:signing-key asset to sign the upload with, which must have purpose `openpgp`

The output will be provided as a debian:upload artifact, with `relates-to` relations to the unsigned artifact.

Used by the package_upload workflow.