Move jar signing to be part of signArchives. (#377)
Move jar signing to be part of signArchives. (#377)

When done immediately before deployment, we sign the jar (and thus modify
it) after the GPG signature has been generated, which causes the signatures
to fail.  This puts the jar signature into the jar first, then generates
the GPG signatures, so everything verifies properly.
google/conscrypt,google/conscrypt,google/conscrypt,google/conscrypt,google/conscrypt,google/conscrypt