HADOOP-19840. Release hadoop-thirdparty 1.6.0: docker setup for mac and maven 3.9.12

[steveloughran]

Fix release tooling for macOS (Apple Silicon) support:

• Dockerfile: install Maven 3.9.12 (Bionic ships 3.6.0, below the required 3.6.3 minimum); validate SHA-512 checksum
• Dockerfile: set JAVA_HOME via arch-aware symlink to support both amd64 and arm64
• Dockerfile: pin wrapt==1.11.2 and lazy-object-proxy==1.4.3 to avoid Python 2.7 incompatible setup.cfg attr: version parsing
• Dockerfile: validate Hugo 0.30.2 .deb SHA-512 checksum
• create-release: fix JAVA_HOME to use arch-aware symlink (script overrides Dockerfile value)
• create-release: mount ~/.gnupg read-only at /gnupg-source and provide a tmpfs at ~/.gnupg with correct uid/gid so gpg-agent can bind its Unix domain socket (macOS volume mounts do not support Unix domain sockets)

---

most of this was done with copilot + claude model; it works on the mac, but I need yetus
to see if it runs too. The fact that the maven upgrade was broken on docker is interesting, as it implies that yetus isn't building through docker.

[steveloughran]

Note that some of this ends up copying my gpg release keys into the docker image for mac deployments. I don't like that. I think I'll do a release on an x86 box to keep secrets out of the image, therefore guaranteeing the secrets aren't in the release.