Simply put, I am wondering why would one need to sign one's commits with a GPG key when contributing to GitHub when one's already required to provide an SSH public key?
When you authenticate to Github with your SSH key, that authentication doesn't become part of the repository in any meaningful or lasting way. It causes Github to give you access for the moment, but it doesn't prove anything to anyone who is not Github.
When you GPG-sign a git tag, that tag is part of the repository, and can be pushed to other copies of the repository. Thus, other people who clone your repository can verify the signed tag, assuming that they have access to your public key and reason to trust it.
While it isn't necessary to tag and GPG-sign every single commit, it is wise to provide GPG-signed tags at least on each commit that corresponds to a released version of your code. You may wish to do more than that, but that is the bare minimum of responsible behavior, as it provides reasonable assurance that:
The commit in question really does correspond to the release in question.
The commit in question (and to the degree that we trust the SHA1 hashes used in git commit history, all of its predecessors) came from the signer (and, if applicable, the signer's team).
The commit in question wasn't tampered with after the signer tagged it.
Note that I said "reasonable assurance", not "perfect certainty"...there are other things that can go wrong with software integrity. However, providing signed tags at least for official releases is a huge step in the right direction.