build: use sha256sum instead of sha1sum to sign releases