Downloading agent and verifying PGP signature

[eyalkoren]

What does this PR do?

Closes #1901

We use the Bouncy Castle FIPS PGP implementation for the jar signature validation.
Since the related Bouncy Castle jars are doing self-checksum validation based on the jar they are coming from, we package them as is in a dedicated lib within the jar, alongside a minimal jar of ours that contains the Bouncy Castle implementation for the internal BouncyCastleVerifier#verifyPgpSignature API.
All these jars are loaded by a dedicated class loader.

Checklist

• I have updated CHANGELOG.asciidoc
• Unit tests:
  • Testing the new argument is parsed properly
  • Testing downloading capabilities
  • Testing PGP signature verification
  • Testing dedicated PGP validation library class loader
• End-to-end tests:
  • Testing downloading and verification
  • Testing downloading after already downloaded
  • Testing wrong version
  • Testing attachment with downloading
  • Testing attachment without downloading (embedded agent or configured agent jar)
  • Testing slim CLI jar - through our integration tests on Jetty, Tomcat and WebLogic with agent 1.25.0
• Add the new CLI option to documentation:
  • in docs
  • in the CLI --help output
• Add the Bouncy Castle license to our license notice

[ghost]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2021-08-22T14:53:02.712+0000

• Duration: 57 min 39 sec

• Commit: 85c9152

Test stats 🧪

Test	Results
Failed	0
Passed	2390
Skipped	17
Total	2407

Trends 🧪

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test	Results
Failed	0
Passed	2390
Skipped	17
Total	2407

[SylvainJuge]

Another question:
Why do we have binary dependencies in the test classpath ? Are they kept in sync through build ?

[SylvainJuge]

LGTM, discussed few details live.