[signal] Add a release-wired UBI image variant (#7458)

* [signal] Add an explicit non-root UBI image variant

Keep the existing signal image unchanged while making a separate UBI image available for local certification-readiness checks. Collect the linked Go dependency license terms as portable build inputs, and use SIGINT for the existing graceful stop handler.

* [signal] Wire the UBI variant into GoReleaser

Build the additive UBI signal variant through the existing release pipeline instead of relying on local Docker commands. Stage its licenses in the per-image build context and restrict the variant to validated AMD64 without changing existing image tags.

* [signal] Align the UBI image with the other UBI variants

Main now ships UBI images for the client, combined server and proxy with
a shared license collector and a common shape, so the signal variant
should look the same to reviewers and to Red Hat certification. Signal
also listens on port 80 by default, which an arbitrary non-root UID
cannot bind on OpenShift or Podman.

Use release_files/collect-licenses.sh instead of a signal-only copy,
build for amd64 and arm64 like the other UBI entries, and run as
1000:0 with a group-writable /var/lib/netbird that also holds Let's
Encrypt data. Default NB_PORT to the legacy gRPC port 10000 so the
image starts unprivileged and serves a single listener.

* [infrastructure] Certify the signal UBI image on release

The signal UBI image is published with every release, but only images
listed in the certification workflow reach the Red Hat catalog, so it
would otherwise need a manual run each time.

Add signal to the dispatch options and the component list, using the
same -ubi tag suffix as .goreleaser.yaml. The run reads its Partner
Connect ID from REDHAT_CERT_ID_SIGNAL.

* [signal] Answer Let's Encrypt challenges on the UBI image's port

The challenge listener defaults to :443, which a non-root UID cannot
bind on OpenShift or Podman, so Let's Encrypt could not work in the
UBI image. Now that the listener address is configurable, default it
to empty so the TLS listener on port 10000 answers the challenges
itself when public port 443 is forwarded to it.

.github/workflows/redhat-certify.yml

@@ -33,6 +33,7 @@ on:
           - client-rootless
           - reverse-proxy
           - netbird-server
+          - signal
       version:
         description: "Released version, e.g. v0.80.0"
         type: string
@@ -68,6 +69,7 @@ jobs:
             "client-rootless ghcr.io/netbirdio/netbird -rootless-ubi"
             "reverse-proxy ghcr.io/netbirdio/reverse-proxy -ubi"
             "netbird-server ghcr.io/netbirdio/netbird-server -ubi"
+            "signal ghcr.io/netbirdio/signal -ubi"
           )
           matrix="[]"
           missing=()