Add sign-public-ecr-image job to release workflow

[wangzlei]

Summary

Backports the sign-public-ecr-image job from aws-otel-python-instrumentation release/v0.14.x to the Java instrumentation release workflow.

Changes

Added sign-public-ecr-image job in .github/workflows/release-build.yml that:

1. Configures AWS credentials using AWS_ASSUME_ROLE_ARN_RELEASE
2. Installs notation CLI with AWS Signer plugin
3. Queries ADOTECRSigningProfile signing profile ARN (gracefully skips if not found)
4. Logs in to public ECR and signs the released image PUBLIC_REPOSITORY:v$VERSION

The job runs after publish-sdk which pushes the multi-arch image to public ECR.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (release/v2.26.x@75cec07). Learn more about missing BASE report.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@                Coverage Diff                 @@
##             release/v2.26.x    #1363   +/-   ##
==================================================
  Coverage                   ?   69.39%           
  Complexity                 ?      704           
==================================================
  Files                      ?       63           
  Lines                      ?     3437           
  Branches                   ?      487           
==================================================
  Hits                       ?     2385           
  Misses                     ?      861           
  Partials                   ?      191           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.