feat: support signing of private plugins

[StephenKing]

While it is documented, how to sign a private plugin, the GitHub actions in this repo don't support this.

In order to allow users the supply the rootUrls argument to npm run sign, this PR introduces a new parameter sign_root_urls, which has to be passed to the build-plugin action, which finally passes it to the package-plugin, which actually does the signing.

Let me know, if there is an alternative, easier way to achieve this.

Fixes: #37

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}