Fixed Policy#inspect

Previously inspect used a \ at the end of the string to continue to the
next line.  Due to a future change to Ruby this has been replaced with
a + to avoid warnings.

Replacing \ with + resulted in incorrect output as + has lower
precedence than % which would cause replacement to occur only for the
second part of the string.

Now the string is enclosed in parentheses to force proper order of
operations.
Always calculate package file digests

The updates for RubyGems 2.x introduced a checksums file for package
integrity.  Tar-format gems built with RubyGems 1.8.x and older do not
have these checksums.

While adding checksums the signing support was disabled for gems without
checksums.  Because the checksums did not exist the digest for signature
verification were not computed.

This commit fixes the package side of signature verification.  Now
digests are computed regardless of the presence of checksums.

A second bug in the verification code needs to check that the number of
signatures and digests match.
Refactor dummy signature generation

Now dummy signatures are all generated in dummy_signatures which can be
splatted onto a call to Policy#verify or #verify_signatures.  This makes
the code a little easier to scan and indicates the signatures should be
ignored as they aren't a particularly important part of the test.

This work is part of ensuring that, when verifying signatures,
signatures are present even if invalid.
Force signatures and digests when verifying

Previously if the user passed an empty digests array verification would
succeed.

This could lead to lack of verification when Package has a bug (such as
54dc22f).

Now digests must be filled and the number of signatures must match the
number of digests (only the reverse was tested previously) to help catch
such bugs.

This check is performed even when data integrity is disabled to warn the
user of tampering.