Broken verification instructions

The verification instructions at
https://github.com/apache/incubator-pekko-site/blob/4f171bca3915c06ee5964e9edf35966e4dec323a/content/download.html#L286
and
https://github.com/apache/incubator-pekko-site/blob/4f171bca3915c06ee5964e9edf35966e4dec323a/content/download.html#L292

are unnecessarily complicated, and will not work in all situations.

Using 'find' may result in applying the command to additional unrelated downloads, depending on where the files are downloaded. It will only work correctly if the files are in a leaf directory with no other hashes or sigs. Find by default traverses all nested directories. Also Windows has a completely different 'find' command.

In addition, safe GPG verification requires both artifact and signature to be provided on the command line [1].

[1] https://www.apache.org/info/verification.html#CheckingSignatures

Open content/download.html around lines 286 and 292, then read the linked Apache verification guidance. Replace the unsafe, platform-specific verification instructions with steps that explicitly provide both artifact and signature files and avoid broad find traversal. Done means the published instructions are unambiguous and work without depending on a leaf directory or Windows find behavior.

Written by the indexing model from the issue text.