cmd/release: upload file.sha256 alongside release binaries

This makes it easier to programmatically verify the
integrity of the binaries.

Fixes golang/go#14385

Change-Id: Ie3688d9b07412018b74d6189ab0d7bc72ef50398
Reviewed-on: https://go-review.googlesource.com/19783
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>