Sign layer using AWS Signer before publishing

[nhinsch]

What does this PR do?

• Add a sign_layers script which uploads built layers to S3, uses AWS Signer to sign them, and then downloads the signed layers back to the developer's machine, replacing the unsigned layers.
• Replace the publish_staging script with publish_sandbox, and publish to the sa-east-1 region to reflect our current practices.
• Update the publish_sandbox and publish_prod scripts to call sign_layers before publish_layers.

Motivation

We want to support the new Code Signing for Lambda feature. This will allow customers to use the layer with functions that are configured to require signed code.

Testing Guidelines

Tested in the sandbox account.

Additional Notes

Before merging this PR, I will need to ensure that the requisite AWS resources and IAM permissions have been set up in the production AWS account.

Types of Changes

• Bug fix
• New feature
• Breaking change
• Misc (docs, refactoring, dependency upgrade, etc.)

Check all that apply

• This PR's description is comprehensive
• This PR contains breaking changes that are documented in the description
• This PR introduces new APIs or parameters that are documented and unlikely to change in the foreseeable future
• This PR impacts documentation, and it has been updated (or a ticket has been logged)
• This PR's changes are covered by the automated tests
• This PR collects user input/sensitive content into Datadog
• This PR passes the integration tests (ask a Datadog member to run the tests)

[DarcyRaynerDD]

This is great work Nick. I just want to verify before we merge this, that the signed layers can still be used by third party aws accounts without any code signing restrictions.