.github/workflows: inject version into source release artifact

Updates FiloSottile#671
Updates golang/go#77020

SIGSUM.md: update policy for v1.3.0

Updates FiloSottile#617

plugin: restrict characters in plugin names

Thanks to ⬡-49016 for reporting this issue.

Fixes GHSA-32gq-x56h-299c

.github/workflows: update artifacts Actions

Co-authored-by: Rene Leonhardt <65483435+reneleonhardt@users.noreply.github.com>

all: temporarily disable testscript tests

They require a replace directive that breaks "go install". Will revert
this after tagging a new latest release.

internal/bech32: remove data length limit

Fixes FiloSottile#453

doc: regenerate groff and html man pages

README: resize and center the logo

age: move the scrypt lone recipient check out of Decrypt

The important one is the decryption side one, because when a user types
a password they expect it to both decrypt and authenticate the file.
Moved that one out of Decrypt and into ScryptIdentity, now that
Identities get all the stanzas. special_cases--

This also opens the door to other Identity implementations that do allow
multiple scrypt recipients, if someone really wants that. The CLI will
never allow it, but an explicit choice by an API consumer feels like
something we shouldn't interfere with.

Moreover, this also allows alternative Identity implementations that use
different recipient types to replicate the behavior if they have the
same authentication semantics.

The encryption side one is only a courtesy, to stop API users from
making files that won't decrypt. Unfortunately, that one needs to stay
as a special case in Encrypt, as the Recipient can't see around itself.
However, changed it to a type assertion, so custom recipients can
generate multiple scrypt recipient stanzas, if they really want.

armor: don't leave an empty line before the footer

Closes FiloSottile#264
Fixes FiloSottile#263