Add AutoStyle key to dependency verification keyring

[sakshichitnis27]

Summary

• Add the AutoStyle 4.0.1 release key to Gradle's checked-in dependency verification keyring.
• Keep signature verification enabled while allowing builds to verify AutoStyle artifacts without reaching an external key server.

Background

JMeter's verification metadata already trusts AutoStyle fingerprint
6FF955169D698CC09BA7403AC99BFE8CD562EAC1, but the corresponding public key
was not present in gradle/verification-keyring.keys.

When the configured public key servers are unavailable, Gradle cannot verify the
AutoStyle 4.0.1 metadata used by the build logic. This stops the build during
:build-logic:build-parameters:compileJava before JMeter itself can be compiled.

This change adds only that public key to the local keyring. It does not disable
dependency verification, ignore the signing key, change a dependency version, or
add a checksum exception.

Verification

• Reproduced the failure with external key servers disabled: the same five
  AutoStyle 4.0.1 artifacts failed verification.
• Verified all eight downloaded AutoStyle 4.0.1 signatures independently against
  fingerprint 6FF955169D698CC09BA7403AC99BFE8CD562EAC1.
• Repeated the restricted-key-server build after adding the key; the build
  configuration completed successfully.
• Ran ./gradlew --quiet check -PjdkTestVersion=21.
• Ran ./gradlew --quiet :src:dist:assemble -PjdkTestVersion=21.
• Verified the generated binary ZIP with unzip -t.

Refs #6713

[milamberspace]

APPROVE — verified this cryptographically rather than taking the PR description at face value, since it touches the dependency-verification keyring.

What I checked

• The diff touches exactly one file, additively: gradle/verification-keyring.keys, +56/-0. No change to verification-metadata.xml — this PR introduces no new trust decision, it only supplies the public key bytes for a fingerprint that was already declared trusted.
• Imported the added PGP key block into a scratch keyring and computed its fingerprint independently: 6FF955169D698CC09BA7403AC99BFE8CD562EAC1, matching exactly what's claimed in the PR body and, more importantly, matching the <trusted-key id="6FF955169D698CC09BA7403AC99BFE8CD562EAC1" group="com.github.autostyle"/> entry already present in verification-metadata.xml — added back on 2026-03-08 by Mend Renovate when bumping AutoStyle to 4.0.1, unrelated to this PR/author.
• Cross-checked the same fingerprint against keys.openpgp.org: identical key, imports as "unchanged". Not a substituted or forged key.
• The UID (AutoStyle releases <sitnikov.vladimir@gmail.com>) matches AutoStyle's actual maintainer.

So this is exactly what the description says: Renovate declared the fingerprint trusted months ago, but the actual key material was never cached locally, so any build without access to an external keyserver fails verification at :build-logic:build-parameters:compileJava — matching #6713 exactly. This PR closes that gap without weakening verification in any way.

CI

First-time-contributor gate — approved the pending workflow run for this commit. Given the change doesn't touch any compiled code (only the keyring file), and I've independently verified the key material and its fingerprint above, I'm approving without waiting on the full run to complete; happy to revisit if it turns something unexpected up.

_{This review was drafted by an AI-assisted tool and confirmed by an Apache JMeter maintainer.}