Initialize pacman keys in build containers (#376)

Recreate pacman's local signing key before upgrading packages so keyring install scripts can sign trusted keys. Keep the key out of the builder image and exercise keyring population with a keyless test image.

tests/build-isolation.Dockerfile

@@ -7,5 +7,7 @@ RUN pacman -Syu --noconfirm git jq sudo && \
     printf '#!/bin/bash\nexec /usr/bin/pacman --ask 4 "$@"\n' > /usr/local/bin/pacman-for-makepkg && \
     chmod +x /usr/local/bin/pacman-for-makepkg && \
     mkdir /src && chown builder:builder /src
+# Match the production image, which does not retain pacman's private key.
+RUN rm -rf /etc/pacman.d/gnupg/private-keys-v1.d
 USER builder
 WORKDIR /src