Check GPG public keys into the repo and package them with SignCheck

Currently, `SignCheck` downloads GPG public keys from remote URLs at runtime during signature verification ([`Utils.DownloadAndConfigurePublicKeys`](https://github.com/dotnet/arcade/blob/main/src/SignCheck/Microsoft.SignCheck/Utils.cs#L195-L220)):

- `https://packages.microsoft.com/keys/microsoft.asc`
- `https://packages.microsoft.com/keys/microsoft-2025.asc`
- `https://packages.microsoft.com/keys/microsoft-rolling.asc`
- `https://raw.githubusercontent.com/microsoft/azurelinux/3.0/SPECS/azurelinux-repos/MICROSOFT-RPM-GPG-KEY`
- `https://dot.net/release-key-2023`

These keys are stable and not expected to change. Checking them into the repo and embedding them as resources in the `SignCheck` package would:

- Remove the runtime network dependency, making SignCheck more reliable in air-gapped or network-restricted environments
- Avoid potential failures if a key URL changes or becomes temporarily unavailable
- Make it explicit which keys are trusted for verification

Raised in https://github.com/dotnet/arcade/pull/16574#discussion_r3101887808.