Enforce GPG verification across multiple distros (Fixes #963)

[chaosoffire]

Description

This PR standardizes and enforces GPG verification requirements across multiple supported distributions. The primary change is the introduction of a validateGPGRequirements helper in common.go, which implements the following logic requested in #963:

• HTTP: A GPG keyring is now strictly required. If a GPG keyring is not specified/available, the build will fail early.
• HTTPS: If a GPG keyring is specified, it is used. If not, the download proceeds with a warning, leveraging the transport layer security of HTTPS but alerting the user to the lack of correct signature verification.
• Explicit Keys: If keys are defined in the source definition, verification is always enforced, regardless of the protocol.

This logic has been applied to almalinux, alpine, archlinux, centos, funtoo, gentoo, rocky, ubuntu, and voidlinux sources.

Specific security fixes included:

• Rocky Linux: Fixed an issue where the CHECKSUM file was downloaded but not verified against its signature.
• CentOS: Fixed an issue where 'SHA256SUM' and 'CHECKSUM' files were downloaded but not GPG verified.
• Gentoo: The portage snapshot download now correctly re-parses the URL and calls validateGPGRequirements, ensuring GPG checks are enforced unless explicitly skipped.

Unit tests for validateGPGRequirements have been added in common_test.go.

Fixes #963

Verification

• Scenario 1: Any protocol with keys — GPG verification is always performed, regardless of skip_verification setting.
• Scenario 2: HTTP without keys — Build fails with an error requiring GPG keys.
• Scenario 3: HTTPS without keys and skip_verification equals false — Build proceeds with a warning about missing GPG verification.

[stgraber]

Thanks!

[stgraber]

@chaosoffire unfortunately this change broke:

• CentOS (https://jenkins.linuxcontainers.org/job/image-centos/architecture=amd64,release=9-Stream,variant=default/lastBuild/console)
• Gentoo (https://jenkins.linuxcontainers.org/job/image-gentoo/architecture=amd64,release=current,variant=openrc/lastBuild/console)
• VoidLinux (https://jenkins.linuxcontainers.org/job/image-voidlinux/architecture=amd64,release=current,variant=default/lastBuild/console)

Actually, most of our image builds started breaking, but the majority were because of outdated GPG keyrings on our side, so that's fine, I fixed those, but the three above appear to be generally broken (looking for non-existing files).

[chaosoffire]

@stgraber Thanks for checking the issues. I'll check the logs for the error and open a follow-up pr shortly.