fix: sign macOS binaries

Description

!2499 (merged) modified the way macOS binaries were signed. Previously GoReleaser only ran binary_signs on an actual release; now the post-build hook only signs the binary if we are on a tag.

To make this work, we need to pass the CI and CI_COMMIT_TAG variables down to GoReleaser.

Related Issues

How has this been tested?

Screenshots (if appropriate):

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation
• Chore (Related to CI or Packaging to platforms)
• Test gap