feat(package) publish the WAR signature file

[dduportal]

Ref. jenkins-infra/helpdesk#4055

Requires jenkinsci/packaging#462 before being merged

This PR is related to jenkinsci/packaging#462: It changes the utils/release.bash script to add the download of the WAR's signature file (generated by Maven during the "release" process) next to the WAR file (same filename with an added suffix .asc).

It allows publishing the GPG signature of the WAR file along with the GPG key used to sign the WAR during the Maven release process.

---

Validations (run with jenkinsci/packaging@c8f0063):

• Ran a weekly build with the "staging only" (+ no windows + line set to "weekly" and version set to "latest") . Result shows we have both the "asc" file and the public GPG key published (both can be used to verify the WAR downloaded file):

• Ran a LTS build with the "staging only" (+ no windows + line set to "stable" and version set to "2.528.3") Result shows we have both the "asc" file and the public GPG key published (both can be used to verify the WAR downloaded file):

---

Note: I've tried to add a verification of the downloaded WAR initially but I had to solve the case of "current LTS uses an old GPG key" which is an edge case. So I've removed the verification from this PR and we'll add it back after 2.541.1

[dduportal]

Removed the debug commit 84be322 (which was testing jenkinsci/packaging#462): ready to review