(CPR-8) Rake task for signing gems

This commit adds a sign_gem task in gem.rake that unpacks, sets the
signing key and adds the cert to the chain for the spec file. These are
passed in by environment variables RUBY_PRIVATE and RUBY_PUBLIC
respectively. It then rebuilds it thus signing the ruby gems.
We probably want to signal some kind of warning here if we're trying to sign a gem that shouldn't be signed. See https://github.com/clantant/packaging/blob/RE-2569/master/signgem/tasks/ship.rake#L69-L84 for an example.