fix my idiotic fingerprint generation bug

same fix as:
https://gitlab.com/fdroid/fdroidclient/commit/649bfa10b77b3a353a26bffad60c5ba6ea7a02a2
order repo metadata in header the same as fdroidserver makes

Just in case...
split out getCertificate() method in LocalRepoKeyStore

This makes it possible to store the certificate in the index XML like the
fdroidserver tools do.  It might be useful elsewhere too..
include 'pubkey' metadata in index.xml like fdroidserver tools

It turns out that the index.jar verification process compares the 'pubkey'
data to the certificate stored in the jar META-INF/.  So Kerplapp needs to
include 'pubkey' in order for repo signing to work.