pmb.chroot.apk_static: use sha256 sig for verification

Folks using pmb v2 on Fedora and other distros that disabled sha1 in
openssl will need this in order to run pmb successfully.

Backported from 7a299b3f