Generalize focal PG core build to a parameterized PG13-17 pipeline - #1185

The packaging signing secrets in this repo (incl. PGAZ_PACKAGE_SECRET_KEY) are
stored as raw ASCII-armored keys, not base64. import_and_sign assumed base64 and
ran `base64 -d` first, which fails on armored input ("base64: invalid input" ->
"no valid OpenPGP data found" -> "secret key not available").

Detect the format: import ASCII-armored keys directly, otherwise base64-decode
as before (backward compatible). Also verify a PRIVATE key was actually imported
and exit non-zero with an actionable message if only a public key is present, so
debsigs never silently emits unsigned packages.

Validated in the xenial debsigner image: armored private key -> signs
(_gpgmaint added); base64 key -> signs; armored public-only key -> exits 78.

build-package.yml and build-package-test.yml trigger on every branch
(branches: "**") and run the Citus extension build plus test_build_packages,
which is unrelated to the PostgreSQL-core focal pipeline and fails here on a
pre-existing PACKAGING_PASSPHRASE mismatch. Exclude pg16-focal via
branches-ignore so it no longer blocks this work; workflow_dispatch stays.

Roll back the earlier workarounds now that signing uses the prebuilt
citusdata/packaging:debsigner image:
- dockerfiles/debsigner/scripts/import_and_sign: back to upstream (we no longer
  build our own signer, so the armored-key handling is unnecessary).
- build-package.yml / build-package-test.yml: restore branches: "**" (drop the
  pg16-focal branches-ignore guard) to avoid touching shared extension CI.

These three files now match develop; only the PostgreSQL-core focal pipeline
remains in this branch.

The signer images are maintained out-of-band (not built by this repo's image
pipeline), so the deployed citusdata/packaging:debsigner has drifted from
dockerfiles/debsigner. Building our own signer from that source could not import
the same signing key that signs every other Citus package, while the deployed
image does (pg-azure-storage nightlies are green with PGAZ_PACKAGE_SECRET_KEY).

Use the prebuilt citusdata/packaging:debsigner with a Docker Hub login and pipe
the passphrase via stdin + env, mirroring citus_package.sign_packages. Pin the
job to ubuntu-20.04 to match the green pg-azure-storage signing pipeline.

Revert the ubuntu-20.04 pin to ubuntu-latest to stay future-proof as GitHub
retires the hosted ubuntu-20.04 image. Signing uses the prebuilt
citusdata/packaging:debsigner image (same as all-citus, which signs fine on
ubuntu-latest), so the runner version is not the relevant factor.

PGAZ_PACKAGE_SECRET_KEY is only referenced on the pg-azure-storage branches and
did not import in our run. Switch to the common signing secrets used across the
other pipelines (PACKAGING_SECRET_KEY / PACKAGING_PASSPHRASE) to match the
standard convention.

Replace the PG16-only focal pipeline with a single parameterized one keyed
on PG_MAJOR, covering every focal-buildable major (PG 13, 14, 15, 16, 17).
PGDG dropped focal binaries once focal reached EOL; these are the majors
that still receive new upstream minors beyond their last focal build.

- scripts/build_pg16_focal -> scripts/build_pg_focal: add PG_MAJOR; auto-
  resolve the latest minor per major from the live pool (PG_UPSTREAM_VERSION
  override stays); static frozen DEBIAN_BASE map per major (focal is EOL, so
  these never change) with a PG_DEBIAN_BASE override; replace the hardcoded
  hurd-iovec drop with a declarative PG_DROP_PATCHES list (default hurd-iovec,
  a no-op where absent) so future drift is a one-line, no-code change. The
  quilt-series gate stays as the fail-loud safety net.
- dockerfiles/pg16-focal-builder -> dockerfiles/focal-pg-builder: one generic
  builder image (focal-pgdg main 13 14 15 16 17); built once, reused per major.
- build-pg16-focal.yml -> build-pg-focal.yml: a setup job computes the matrix
  (single major via workflow_dispatch, or all 13-17), build-and-sign matrixes
  over majors with fail-fast: false; sign/verify/upload are unchanged but
  namespaced per major. Trigger on the pg-focal branch.

Validated end-to-end for all five majors (full 13-package set each, depending
on focal-native libllvm10/libssl1.1, hurd-iovec dropped only on 16/17):
  13.23, 14.23, 15.18, 16.14, 17.10.

The debsigner entrypoint signs exactly "/packages/*/*.deb" (one directory
level deep) and, with no nullglob, passes the unexpanded literal to debsigs
when nothing matches -> "File /packages/*/*.deb does not exist".

The build writes to packages/focal/pg<major>/, so mounting ${PWD}/packages
left the debs one level too deep (/packages/focal/pg<major>/*.deb) and the
glob matched nothing. Mount ${PWD}/packages/focal instead, so the signer
sees /packages/pg<major>/*.deb. Verified against citusdata/packaging:debsigner.

Two issues with the multi-major focal output:

1. Debug-symbol packages were missing. dpkg-buildpackage emits them as .ddeb
   on Ubuntu, but the collection step copied only *.deb, so every dbgsym was
   silently dropped. Collect them too, renamed .ddeb -> .deb (Debian's own
   convention; identical on-disk format), so they flow through the existing
   debsigs signing, _gpgmaint verification and artifact upload unchanged.

2. Installing PG 13-17 on one machine conflicted on the shared libraries.
   Each major's source builds six single-instance system libraries with the
   same package name but a per-major version -- libpq5, libpq-dev, libpgtypes3,
   libecpg6, libecpg-dev, libecpg-compat3 (plus their -dbgsym) -- so they
   cannot be co-installed. The newest copy satisfies every major's ">="
   dependency. Add an "assemble" job that, after the per-major matrix, keeps
   all per-major packages from every major but the shared libraries only from
   the highest major present, guards against duplicate package names, and
   uploads a flat, de-duplicated postgresql-all-focal artifact. Per-major
   artifacts are retained for traceability. Packages are copied byte-for-byte,
   preserving their signatures.

Validated end-to-end (PG 13-17): dbgsym now collected (~11 per major); the
combined set is 72 packages with no duplicate names and a single 17.10 copy of
each shared lib; PG 13-17 co-install on a clean focal container with no
conflicts and all server binaries reporting the expected versions.

The assemble step assembled correctly but failed under set -euo pipefail:
the diagnostic loop used `[[ ... ]] && echo ...`, which returns non-zero on
the last package when it isn't a shared lib; piped into sort that made the
whole step exit 1. Use an explicit `if` so the loop ends with status 0.

Also drop `cp -n` (newer coreutils warns it's non-portable, and the flag is
unnecessary -- after de-dup no destination filename collides) for plain `cp`.

PG17 is not needed up front, so the default "all" matrix now builds
13..16 only. PG17 stays fully supported and selectable -- dispatch with
pg_major=17 to build it; scripts/build_pg_focal and the builder image
still carry the 13..17 support they always had.

The assemble job derives the newest major from the artifacts it actually
receives, so the combined set now takes the six single-instance shared
libraries (libpq5, libpq-dev, libpgtypes3, libecpg6, libecpg-dev,
libecpg-compat3) from PG16 instead of PG17 with no code change.

Also align action versions with develop: actions/checkout v4 -> v6 and
docker/login-action v2 -> v4 (v2 runs on the deprecated Node 16 runtime).