fix(gpg-verify): prefix gpgv --keyring with gnupg-ring: for Windows paths

[wnoonan]

What

Prefix the gpgv --keyring argument with gnupg-ring: so signature verification works on Windows.

Why

The verify-on-download path runs gpgv --keyring <path>. On Windows the keyring lives at a drive-letter path (C:/...), and gpgv reads the leading C: as a URL scheme, failing with invalid key resource URL 'C:/...'. Broke Windows builds pulling js2bin#master.

Fix

gnupg-ring: tells gpgv the value is a literal keyring filename, not a URL. No-op on POSIX paths.

Test

Added a regression test that puts the keyring under a colon-prefixed dir, reproducing the misparse on any platform. All 7 tests pass

[theothergraham]

I verified this fix works for me on the host where I ran into the issue. Others are not seeing the issue and I have been unable to figure out why, but this look like a safe fix to me.

[avcribl]

It looks good to me!