Fix alpine failures by switching default back to only warn on verification failures. To prevent build failures due to missing GPG or rotated vendor keys. (#1262)

Also allow multiple GPG keys to be provided.

Co-authored-by: John <1615532+johnoliver@users.noreply.github.com>

dist/setup/242.index.js

@@ -226,6 +226,7 @@ class JavaBase {
     floatingVersionVerified = false;
     setDefault;
     verifySignature;
+    verifySignatureExplicitlyRequested;
     verifySignaturePublicKey;
     constructor(distribution, installerOptions) {
         this.distribution = distribution;
@@ -246,6 +247,8 @@ class JavaBase {
                 : true;
         this.verifySignature =
             installerOptions.verifySignature ?? this.supportsSignatureVerification();
+        this.verifySignatureExplicitlyRequested =
+            installerOptions.verifySignature === true;
         this.verifySignaturePublicKey = installerOptions.verifySignaturePublicKey;
     }
     async downloadAndVerify(javaRelease) {
@@ -481,7 +484,7 @@ class JavaBase {
             architecture: this.architecture,
             version: javaRelease.version,
             source: this.getJdkReleaseIdentity(javaRelease),
-            verification: getJdkVerificationIdentity(this.verifySignature, this.verifySignaturePublicKey),
+            verification: getJdkVerificationIdentity(this.verifySignature, this.verifySignatureExplicitlyRequested, this.verifySignaturePublicKey),
             path: this.getJdkCachePath(javaRelease.version)
         };
     }