Build Security: airgapped caching and golden hash generation

[artoonie]

Closes #756: airgapped cache
Closes #759: hash of trusted build

This pull request does four things:

1. It caches all dependencies and zips them up, one cache zip per OS, so that RCTab can be built on airgapped machines with minimal other dependencies. (You still need Java and Gradle.)
2. It creates a "golden hash" for the jlinkZip. This is a reproducible value per OS, meaning it contains no timestamps in the zip.
3. The cache zip's version of a "golden hash" is in a file checksums.csv, which lists a checksum per dependency. That file has an MD5, a SHA-1, and a SHA-256, because we want to correspond our values to those on maven.org, and we don't know what sort of checksum is uploaded to maven.org (it varies by dependency).
4. Use .gitattributes to enforce LF line endings for cross-platform, cross-machine consistency

After code review, I will:

1. Increase the .zip retention to 90 days (it's set to 1 during testing)
2. Revert the change in .github/workflows/release.yml that creates a package on every push to this branch
3. Update the wiki to reflect the changes in generating the golden hash

[yezr]

#759 has the hash.bat contents that previously anyone could use to verify the golden hash of their local copy. Has that local verification process changed? If so, can you detail that in #759

[artoonie]

Yes, the hash.bat process has changed. After this, it will be sufficient to run ./sha-of-zip.sh <zipFilepath> <OS: Windows, MacOS, or Linux> <sha version: 1, 256, or 512> or ./sha-of-zip.bat <ZIP_FILEPATH> <sha version: 1, 256, or 512> to get the golden hash. I can update the wiki to reflect that when this is merged.

[tarheel]

I'll let @HEdingfield tackle this one!

[tarheel]

What a time to be alive.

[yezr]

I've edited the wiki with steps on golden hash generation. Can those please also get a review

[artoonie]

Reviewed! Looks good. I made a couple cosmetic updates and added some details clarifying where instructions were Windows-only.