F-Droid - enable reproducible builds

given current events, ahem https://nextcloud.com/blog/nextcloud-android-file-upload-issue-google/ ahem, maybe we can ease the switch from Play

currently F-Droid employs two ways to get repro builds

looking at the graph https://f-droid.org/docs/Reproducible_Builds/

branches YES-YES, only one APK is published signed by upstream, after verification, autoupdates are possible

branches NO-YES-YES, two APKs are published, one signed by F-Droid and one by you, after verification, no autoupdates

but, Nextcloud does not use autoupdates, only Dev

the app has been reproducible for a while, https://verification.f-droid.org/packages/com.nextcloud.client/

I've opened a draft MR to verify, and it's all green: https://gitlab.com/fdroid/fdroiddata/-/merge_requests/22696

the workflow is this:
* on new installs, users get your signed APK
* on updates from your signed APK, eg. from Play, they get your signed APK
* on updates from F-Droid signed APK, they continue to get the F-Droid one

the dev workflow changes a bit, when you open a MR to update, you'll also include the extracted signatures from your signed APK, by running `fdroid signatures --verbose nextcloud-XXXX.apk`

thoughts?