[JENKINS-37567] - Add option to specify certchain, enforce certificate checks

[oleg-nenashev]

It should finalize JENKINS-37567.

• - Add certchain option (requires a custom profile now)
  • See [MJARSIGNER-53] - Add support of the "certchain" option in the "sign" mojo apache/maven-plugins#125 and [MJARSIGNER-53] - Add support of the "certchain" parameter in JarSigner sign operation apache/maven-shared#24
• - Start REALLY validating the signing correctness when the release flow is enabled

I have checked the default options, the change does not impact the local dev build and @kohsuke 's release flow. I am quite aware about the jarsigner -tsa step in the release profile, but it seems to be harmless on my local machine.

@reviewbybees @olamy @kohsuke

[oleg-nenashev]

@olamy Likely I should create a MJARSIGNER issue for adding this parameter. I would argue it should be enabled by default in Java's jarsigner or in at least Maven JarSigner Plugin, but it would be a potentially breaking change

[ghost]

This pull request originates from a CloudBees employee. At CloudBees, we require that all pull requests be reviewed by other CloudBees employees before we seek to have the change accepted. If you want to learn more about our process please see this explanation.

[alexanderrtaylor]

LGTM
🐝

[oleg-nenashev]

@reviewbybees done

[oleg-nenashev]

Merging in order to proceed with the release

[aheritier]

LGTM 🐝 Sorry for the delay @oleg-nenashev