PGPPublicKey.join modifies the key passed in #2508

PGPPublicKey.join(key, copy, …), and through it PGPPublicKeyRing.join and OpenPGPCertificate's merging, copies key.idSigs only shallowly and then merges the copy's certifications into the inner lists. As a result, joining also adds certifications to the caller's key, or replaces them in it. For example, after PGPPublicKeyRing.join(base, cert2SignsBase) (the Sequoia merge vectors in PGPPublicKeyMergeTest), base.getEncoded() has changed.

This has been the behavior since join was added in 1.71.

Fix: copy each user ID's signature list as well, as the PGPPublicKey copy constructor already does.