Safeguarding GNOME.org with an upload lockdown

That is something I'd like to see, but not that easy as:
- tarball is more than just a tag from git
- ./autogen.sh and make dist have various dependencies; these aren't static
- we do this on a server, don't want to touch it
- sometimes make dist even creates a ChangeLog from git, etc

So though I'd like to see this, it is rather difficult. For short term security again it is easier to focus on something I can achieve.