"RPM packages signed with SHA-1 is considered unsafe" rpm package signing update requested

#### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

When filing a bug, please include the following headings if possible. Any
example text in this template can be deleted.

#### Overview of the Issue

Red Hat Enterprise Linux and related Fedora and CentOS projects are moving to block use of packages signed with SHA1 hash.

The signing of the Hashicorp RPM packages should be updated to avoid errors for users being either unable to upgrade packages, or being unable to install these packages at all.

https://access.redhat.com/solutions/6868611

> Root Cause
>
> The SHA-1 message digest has been deprecated in Red Hat Enterprise Linux 9. The digest produced by SHA-1 is not considered secure because of many documented successful attacks based on finding hash collisions. The RHEL core crypto components no longer create signatures using SHA-1 by default. Applications in RHEL 9 have been updated to avoid using SHA-1 in security-relevant use cases. This causes issues when using DNF/RPM to handle packages with RSA/SHA1 signatures as the signature cannot be checked with the default cryptographic policy. Any such packages cannot be installed, removed, or replaced unless the signature check is disabled in DNF/RPM or SHA-1 is enabled using non-default crypto-policies.

https://discussion.fedoraproject.org/t/third-party-rpms-with-an-invalid-signing-key-might-cause-errors-during-package-operations/80077

https://www.scrye.com/wordpress/nirik/2023/01/31/error-rpmdbnextiterator-skipping-in-fedora-38/

#### Reproduction Steps

Install Packer RPM package from Hashicorp repository:

https://rpm.releases.hashicorp.com/RHEL/$releasever/$basearch/stable
https://rpm.releases.hashicorp.com/fedora/$releasever/$basearch/stable

### Packer version

1.8.7

### Operating system and Environment details

Red Hat Enterprise Linux 8 & 9
Fedora 38 and future Fedora 39 release

Start with the RPM repository URLs and the installation reproduction steps for Packer 1.8.7 on RHEL 8/9 and Fedora 38. Investigate how the HashiCorp RPM packages are signed and verify the result with DNF/RPM under the default crypto policy; done means the packages no longer trigger SHA-1 signature errors.

Written by the indexing model from the issue text.