ci: make sure the tag being pushed is both annotated and signed

Just using '-p' would simply pretty-print the referenced commit for
unannotated tags, which would then pass the check since we require
signed commits. So make sure the tag really is annotated and signed.

.github/workflows/publish-android.yml

@@ -27,7 +27,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: ensure the tag is signed
-        run: git cat-file -p ${{ github.ref_name }} | grep -q -- '-----BEGIN PGP SIGNATURE-----'
+        run: git cat-file tag ${{ github.ref_name }} | grep -q -- '-----BEGIN PGP SIGNATURE-----'
       - name: set up jdk 17
         uses: actions/setup-java@v4
         with:

.github/workflows/publish-jvm.yml

@@ -27,7 +27,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: ensure the tag is signed
-        run: git cat-file -p ${{ github.ref_name }} | grep -q -- '-----BEGIN PGP SIGNATURE-----'
+        run: git cat-file tag ${{ github.ref_name }} | grep -q -- '-----BEGIN PGP SIGNATURE-----'
       - name: setup rust
         uses: actions-rust-lang/setup-rust-toolchain@v1  # this implicitly caches Rust tools and build artifacts
         with:

.github/workflows/publish-swift.yml

@@ -26,7 +26,7 @@ jobs:
           xcode-version: '14.3.1'
       - uses: actions/checkout@v4
       - name: ensure the tag is signed
-        run: git cat-file -p ${{ github.ref_name }} | grep -q -- '-----BEGIN PGP SIGNATURE-----'
+        run: git cat-file tag ${{ github.ref_name }} | grep -q -- '-----BEGIN PGP SIGNATURE-----'
       - name: "setup rust"
         uses: actions-rust-lang/setup-rust-toolchain@v1  # this implicitly caches Rust tools and build artifacts
         with:

.github/workflows/publish-wasm.yml

@@ -23,7 +23,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: ensure the tag is signed
-        run: git cat-file -p ${{ github.ref_name }} | grep -q -- '-----BEGIN PGP SIGNATURE-----'
+        run: git cat-file tag ${{ github.ref_name }} | grep -q -- '-----BEGIN PGP SIGNATURE-----'
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
           target: wasm32-unknown-unknown