Sign rpm repo metadata

[wadells]

Note: Do not merge until the backports are ready. We need all branches that publish RPMs to sign, lest we have an old branch regenerate metadata, invalidating a signature from a newer branch.

Also, as of 2021-12-19, the testing for this PR is now complete.

Summary

This PR introduces signing for RPM repo metadata in addition to the RPMs themselves.

This helps support zypper on Suse (#6445), and improves our general RPM
distribution security posture. The threat model is someone compromises
AWS, but not our signing keys. In this case, they could update repo
metatdata to point to an unsigned package. With metadata signed, this
is no longer possible -- both the index and the package are verified by
the various yum clients.

For more info on this change, see this very helpful blog post:

https://blog.packagecloud.io/eng/2014/11/24/howto-gpg-sign-verify-rpm-packages-yum-repositories/

Contributes to #6445.

Testing Done

In progress. I've tested this workflow with the following dockerfiles, but I've not tested the Drone implementation yet.

FROM registry.suse.com/suse/sle15
RUN zypper addrepo --gpgcheck-strict https://rpm.walt.local/teleport.repo
RUN zypper --non-interactive --gpg-auto-import-keys install teleport
RUN teleport version

FROM centos
RUN yum -y update && yum -y install yum-utils && yum -y clean all && rm -rf /var/cache
RUN yum-config-manager --add-repo https://rpm.walt.local/teleport.repo
RUN yum -y install teleport
RUN yum -y --showduplicates list teleport

I removed the S3 upload for deb, rpm, and regular artifacts from the publishing job in a private branch. I then pushed v9.0.0-dev.1 and tried a publish to make sure everything runs to completion. Good thing too, as I caught a couple failures related to gpg 2.0 vs gpg 2.2. See the final, successful test run here:

https://drone.teleport.dev/gravitational/teleport/9603/1/9

[webvictim]

LGTM, although it's been a while since I edited Drone YAMLs in anger...

[wadells]

Backports are up: #9623, #9624, #9625.

Once those are approved (and we're not actively releasing anything for a day or two), I'll merge all of these in the same window.

[wadells]

The force push/new commit was to resolve a conflict with the .drone.yml signature.