docs: document how workflows and actions operate

[jku]

This should not be extensive but a diagram or or something would be helpful: what triggers workflows and how are actions called.

In addition finding this documentation from the workflow files should be easier (see discussion in sigstore/root-signing-staging#3 (comment)) -- maybe a README in the directory. As a special case the publish workflow could have a mention that it is dispatched by online-sign since that is a little surprising.