Use pgp-maven-plugin instead of maven-gpg-plugin

The maven-gpg-plugin is waaaaay too inflexible for our needs. In
particular, it has only two modes to obtain the pass phrase for the
keyring -- both of them inconvenient: the interactive prompt will prompt
*everytime* something is signed (and in default mode, we will want to
sign the artifact, the javadoc, the sources, and of course .pom files
for all of them!) while the gpg-agent mode pretty much excludes headless
operation altogether -- and it is limited to a single keyring.

Instead, let's use the awesomeness that is Kohsuke Kawaguchi's work that
lets us specify the location of the key ring in those forms:

* current user's GPG info in $HOME/.gnupg/secring.gpg

	-Dpgp.keyring=keyring:

* different keyring:

	-Dpgp.keyring=keyring:keyring=path/to/keyring

* file exported via `gpg --export-secret-keys KEYID`:

	-Dpgp.keyring=keyfile:path/to/key.asc

Likewise there are multiple options for specifying the pass phrase:

* via command-line (unsafe):
	-Dgpg.passphrase=literal:<passphrase>

* via file (needs to take precautions to protect the file):

	-Dgpg.passphrase=file:path/to/textfile

* via gpg-agent:

	-Dgpg.passphrase=gpg-agent

Both keyring loader and pass phrase loader are actually *very* easily
customized: simply add a plugin dependency that has a class annotated
with @Component(role=PassphraseLoader.class,hint="file") similar to

	https://github.com/kohsuke/pgp-maven-plugin/blob/master/src/main/java/org/kohsuke/maven/pgp/loaders/FilePassPhraseLoader.java

Seeing how easy the pgp-maven-plugin makes things makes you wonder why
the Maven mavens did not get the memo and improved the maven-gpg-plugin
accordingly...

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>