verify upstream source signature
    
    Per the packaging guidelines¹.  Update URL to use https as well.
    
    While adjusting the git ignore rules for the signature file, also remove
    many older tarball entries and an incorrect entry for the spec file.
    Replace them with simple globs.  Ignore expanded source directories as
    well.
    
    ¹ https://docs.fedoraproject.org/en-US/packaging-guidelines/#_verifying_signatures