Only GPG sign artifacts during "deploy" phase, fixes #3

This POM tweak should make it easier for others to install the jar
without needing any GPG supporting infrastructure, while still allowing
me to sign and deploy artifacts to Maven Central.