Merge BlockstreamResearch/secp256k1-zkp#315: ci: Backport LLVM apt signature fix

040673bd44 ci, docker: Fix LLVM repository signature failure (Hennadii Stepanov)

Pull request description:

  Cherry-pick of bitcoin-core/secp256k1@0ffb1749a5

  Fixes Docker build CI failure caused by Debian's Sequoia PGP policy rejecting SHA-1 signatures from the LLVM apt repository.

ACKs for top commit:
  real-or-random:
    utACK 040673bd44

Tree-SHA512: d524472a3e74abd787007d453e62e2ae28458e37fa2eaf28ee3f1379634e9f34419a5e06fe52d627ea010f634dcbeb6264ff73b60005cb4622b81c69ffd22e28

ci/linux-debian.Dockerfile

@@ -66,6 +66,9 @@ RUN \
     wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc && \
     # Add repository for this Debian release
     . /etc/os-release && echo "deb http://apt.llvm.org/${VERSION_CODENAME} llvm-toolchain-${VERSION_CODENAME} main" >> /etc/apt/sources.list && \
+    # Temporarily work around Sequoia PGP policy deadline for legacy repositories.
+    # See https://github.com/llvm/llvm-project/issues/153385.
+    sed -i 's/\(sha1\.second_preimage_resistance =\).*/\1 9999-01-01/' /usr/share/apt/default-sequoia.config && \
     apt-get update && \
     # Determine the version number of the LLVM development branch
     LLVM_VERSION=$(apt-cache search --names-only '^clang-[0-9]+$' | sort -V | tail -1 | cut -f1 -d" " | cut -f2 -d"-" ) && \