Automate release process

[colek42]

When a new version of upstream in-toto is tagged it should kick off a release in this repo

• Compile tagged release from in-toto-golang for all supported arch
• Pack resulting binaries with UPX
• Make a PR in this repo

[adityasaky]

I think it might be better to have the index.js run go install to get the necessary binaries. I don't love it but it may be preferable to checking binaries in?