use jarsigner to verify the APK signature is valid

use jarsigner to verify the APK signature is valid

By using jarsigner here, we can get rid of getsig.java, since the rest of
what getsig.java does can easily be handled in python.  This simplifies
installation and deployment, and makes things work better cross-platform.
This also means that the fdroidserver Debian package no longer needs to
Build-Depends: on default-jdk, which makes builds in pbuilder run a lot
faster. :-)

refs #5 https://gitlab.com/fdroid/fdroidserver/issues/5