Migrate from github.com/ProtonMail/go-crypto for OpenPGP verification

Summary

Migrate the repository away from the pre-existing github.com/ProtonMail/go-crypto OpenPGP dependency.

Rationale

Pull request #109 uses the existing OpenPGP verification path for Red Hat checksum signature verification. The dependency was already present before that pull request. This migration is out of scope for #109, but it should be tracked separately.

Affected areas

• go.mod
• go.sum
• pkg/utils/gpg.go
• pkg/tools/butane/butane.go
• OpenPGP signature verification tests

Required changes

Select and integrate a maintained OpenPGP implementation that supports the repository's detached-signature and inline-signed-message verification requirements. Update the affected verification code and tests. Preserve the current verification behavior, including verification with pinned armored public keys.

Acceptance criteria

• The repository no longer imports github.com/ProtonMail/go-crypto.
• pkg/utils/gpg.go verifies detached signatures and inline signed messages with the replacement implementation.
• pkg/tools/butane/butane.go continues to verify its downloaded artifact signatures.
• Existing OpenPGP verification tests are updated or replaced with equivalent coverage.
• Invalid signatures, invalid keys, missing keys, and malformed signed content fail safely.

Backlinks

• Follow-up from PR #109: https://github.com/openshift/backplane-tools/pull/109
• Related review comment: https://github.com/openshift/backplane-tools/pull/109#issuecomment-5291494452
• Requested by: @Sushant2504