chore: prepare 0.4.0 release

[tisonkun]

Summary

• bump the datasketches package and lockfile version to 0.4.0
• finalize the changelog heading as v0.4.0 without a release date
• make RELEASE.md reusable by defining the release, previous-release, RC, artifact, and signing-key values once instead of hardcoding the current release
• build the signed ASF source archive directly from the immutable RC tag and stage the three reviewed files through SVN, without depending on bashDeployToDist.sh or generated git.properties
• retain the crates.io RC workflow while distinguishing it from the ASF source candidate

Validation

• cargo update -w --locked --verbose
• cargo x lint
• cargo x check
• cargo x prepare-testdata
• cargo x test
• cargo package --list -p datasketches
• cargo publish --dry-run --locked -p datasketches
• parse every Bash block in RELEASE.md with bash -n
• git diff --check

Review notes

• The changelog keeps historical release dates. The v0.4.0 heading stays undated during RC voting; a post-release pull request records the actual date and opens a new Unreleased section.
• The generated crates.io package currently omits the repository-level LICENSE, NOTICE, and CHANGELOG.md, leaving the packaged README license and changelog links unresolved. This pre-existing packaging issue is intentionally not expanded into this PR.