Add signing to the Android jobs
This MR adds the config files needed for APK signing from !124 (closed) (updated for the production system) and it adds signing of the APK to the Android jobs.
With respect to the project settings: For Kasts only a release version is built on Binary Factory, but I think it's okay if we also allow signing APKs built from the master branch. I didn't add Digikam and Marble to the project settings because they never had a successful build on Binary Factory (as far as the history goes).
signapk.py is run unconditionally for every branch, but it checks if the current project branch is cleared for signing. If it isn't cleared, then the APK is left unsigned. Otherwise, the APK is signed with the help of the signing service.
ci-notary-service!9 (merged) contains the changes to allow running signapk.py unconditionally.
I have test-run this (with a separate job run after the original craft-android job but with identical setup as this job):
- once with an uncleared branch: https://invent.kde.org/pim/itinerary/-/jobs/1245921
- and again after adding the branch (temporarily) to the project settings: https://invent.kde.org/pim/itinerary/-/jobs/1245942