ci: run the release workflow via push tag events

[suzuki-shunsuke]

Close #1825

This pull request allows us to trigger the release workflow when a tag is created.
Note that the workflow is run twice when a workflow_dispatch event or a schedule event is triggered but there is no problem because steps of the second workflow run are skipped in that case.

Melange Pull Request Template

Functional Changes

• This change can build all of Wolfi without errors (describe results in notes)

Notes:

SCA Changes

• Examining several representative APKs show no regression / the desired effect (details in notes)

Notes:

Linter

• The new check is clean across Wolfi
• The new check is opt-in or a warning

Notes:

[suzuki-shunsuke]

I can't find any contribution guide except for CODE_OF_CONDUCT.md.

[suzuki-shunsuke]

https://github.com/chainguard-dev/melange/pull/1826/checks?check_run_id=37980098044

2 errors occurred:
	* failed to parse signature: asn1: structure error: tags don't match (16 vs {class:0 tag:13 length:77 isCompound:true}) {optional:false explicit:false application:false private:false defaultValue:<nil> tag:<nil> stringType:0 timeType:0 set:false omitEmpty:false} ContentInfo @2
	* Signature Verification Error: Invalid signature caused by openpgp: signature made by unknown entity

🤔 My commit is signed by GPG key and the commit message has Signed-off-by.

[xnox]

https://github.com/chainguard-dev/melange/pull/1826/checks?check_run_id=37980098044

2 errors occurred:
	* failed to parse signature: asn1: structure error: tags don't match (16 vs {class:0 tag:13 length:77 isCompound:true}) {optional:false explicit:false application:false private:false defaultValue:<nil> tag:<nil> stringType:0 timeType:0 set:false omitEmpty:false} ContentInfo @2
	* Signature Verification Error: Invalid signature caused by openpgp: signature made by unknown entity

🤔 My commit is signed by GPG key and the commit message has Signed-off-by.

that's not a required check, no action required =)