update: Fix signing verification with digests/packagesite

This updates repo_archive_extract_file() to always write
the extracted file if 'dest' is set, regardless of dest_fd.

The problem was that digests was extracted directly to a fd
but never extracted to a file for rsa_verify() and sha256_file()
to use.

rsa_verify() and sha256_file() could be improved to read from
a fd instead.