we store the key in our git repo so we are sure we get exactly same
build from same git checkout.

ref #9552

The package simply needs the openssl binary which is also provided by
the libressl package and currently libressl is still our default openssl
implementation.

The same key is not always written to the same file. Since we simply
concatenate it we might end up with different trusted keys files.

Sort the file using the key string to make the build reproducible.

This includes the new root trust anchor.

I consider this superior to the solution provided in [1] as it uses a
python tool recommended by the iana [2] for fetching the root trust
anchors. This tool also takes care of verifying their accuracy by
checking the S/MIME signature.

See also #9552.

[1]: https://github.com/alpinelinux/aports/pull/5400
[2]: https://github.com/iana-org/get-trust-anchor

This commit updates $license variable in all APKBUILDs to comply with
short names specified by SPDX version 3.0 [1] where possible. It was
done using find-and-replace method on substrings inside $license
variables.

Only license names were updated, not "expressions" specifying relation
between the licenses (e.g. "X and Y", "X or Y", "X and (Y or Z)") or
exceptions (e.g. "X with exceptions").

Many licenses have a version or multiple variants, e.g. MPL-2.0,
BSD-2-Clause, BSD-3-Clause. However, $license in many aports do not
contain license version or variant. Since there's no way how to infer
this information just from abuild, it were left without the variant
suffix or version, i.e. non SPDX compliant.

GNU licenses (AGPL, GFDL, GPL, LGPL) are especially complicated. They
exist in two variants: -only (formerly e.g. GPL-2.0) and -or-later
(formerly e.g. GPL-2.0+). We did not systematically noted distinguish
between these variants, so GPL-2.0, GPL2, GPLv2 etc. may mean
GPL-2.0-only or GPL-2.0-or-later. Thus GNU licenses without "+" (e.g.
GPL2+) were left without the variant suffix, i.e. non SPDX compliant.

Note: This commit just fixes format of the license names, no
verification has been done if the specified license information is
actually correct!

[1]: https://spdx.org/licenses/

- use https for signature and pgp key
- use gnupg2