gradle: fix pom signing: fetch secring.gpg