Add support for Debian package signing

[adrianabedon]

This change aims to add support for signing Debian packages upon direct upload to a repository. Matches current package signing support in pulp_rpm and also adds the ability to override the signing key fingerprint per release.

TODO

• Changelog
• Tests
• Docs

closes #1300

[quba42]

Sounds interesting! We have seen the tech preview in pulp_rpm. I don't know the details of how exactly package signing in the APT ecosystem works. If you have some docs you can point us at, that would help us once we get around to start reviewing.

[daviddavis]

@quba42 here are the Debian docs on signing packages:

https://www.debian.org/doc/manuals/securing-debian-manual/deb-pack-sign.en.html#check-pkg-sign

Here's our own docs about how to manually verify package signatures:

https://github.com/microsoft/linux-package-repositories?tab=readme-ov-file#verify-the-signature-of-an-individual-deb

This doc has a bit more info including how to configure dpkg to verify signatures:

https://blog.packagecloud.io/how-to-gpg-sign-and-verify-deb-packages-and-apt-repositories/

I think it's worth mentioning that there's another way to sign with packages (dpkg-sig) but it's been removed from Debian:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1049449