Add attributes to manifests: Permissions, Codebase, Application-Name
Improve JAR signing: enforce pack/sign/compress order with depends, sign with both SHA-1 and SHA-256