feat(release): add reproducible signed artifacts (#19)

eng/release-policy.json

@@ -0,0 +1,27 @@
+{
+  "schemaVersion": 1,
+  "packageRegistry": "https://git.finalfactory.de/api/packages/HeiKyu/nuget/index.json",
+  "containerRepository": "git.finalfactory.de/heikyu/rendezvous",
+  "allowedLicenseExpressions": [
+    "Apache-2.0",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "MIT"
+  ],
+  "dependencyLicenseOverrides": {
+    "xunit.abstractions/2.0.3": {
+      "license": "Apache-2.0",
+      "reason": "Legacy package predates NuGet SPDX metadata; reviewed against the xUnit.net Apache-2.0 license."
+    }
+  },
+  "publishedPackages": [
+    "FinalFactory.Rendezvous.Client",
+    "FinalFactory.Rendezvous.Contracts"
+  ],
+  "forbiddenArtifactNameFragments": [
+    "credential",
+    "password",
+    "private-key",
+    "signing-key"
+  ]
+}