bump checksum-dependency-plugin to 1.86, so public pgp keys could be stored under the source control

[vlsi]

Fixes #5749

This commit brings PGP key caching under the source control, so building JMeter would no longer require receiving keys from the keyservers.

Note:

• the stored PGP keys are shortened (e.g. signatures, and images are excluded)
• checksum.xml enforces full key fingerprints for now, so it avoids short key collisions if any
• short key is the last 8 bytes from the full fingerprint. For instance, old key 1c8d5ef0df2b70d4 becomes 07dbc3c1ab1f4468471656061c8d5ef0df2b70d4