Create ad-hoc GPG secret on the fly when PGP_SECRET/PGP_PASSPHRASE don't exist

[sideeffffect]

This will make the UX of using this plugin even smoother = better.
Most people don't care about the GPG signing, they just want to get their package published and this will make it easier.

[ckipp01]

Thanks for bringing this up. Do you feel like this is a blocker for people though? I can't personally say I've ever heard anyone complain about this, even when using sbt for example. It's just sort of assumed to be best practice and expected that you do this. I'm not 100% sure I want to provide a way for people to do this.