Move gpg signing to profile

So that you don't need to have the keys just to build/install anything.
Also done as profile because if we just removed the <executions> it has
been observed to produce bad GPG signatures.
Merge pull request #111 from spotify/drewc/maven-gpg

Move gpg signing to profile