Use PySequoia to parse signatures & not break on PQC signatures

[dralley]

closes #2237

📜 Checklist

• Commits are cleanly separated with meaningful messages (simple features and bug fixes should be squashed to one commit)
• A changelog entry or entries has been added for any significant changes
• Follows the Pulp policy on AI Usage
• (For new features) - User documentation and test coverage has been added

See: Pull Request Walkthrough

[dralley]

Still needed: test that it actually resolves the issue

We may need to update ManifestSignature to store fingerprints in a subsequent PR since V6 signatures do not have keyids.

This PR just truncates to a key ID from a full fingerprint

Yes. In OpenPGP v6 (RFC 9580), the Key ID is defined as the first 8 bytes (high-order 64 bits) of the 32-byte fingerprint (which is a SHA-256 hash).

This is a reversal from v4, where the Key ID was the last 8 bytes (low-order 64 bits) of the 20-byte SHA-1 fingerprint.

That said, the v6 spec strongly discourages relying on Key IDs for identification — the full 32-byte fingerprint is preferred. The truncated Key ID exists mainly for backward compatibility in packet formats that have a fixed 8-byte key ID field (e.g., PKESK packets, Issuer Key ID subpackets), but v6 introduces alternatives that carry the full fingerprint instead (e.g., the Issuer Fingerprint subpacket replaces the Issuer Key ID subpacket).