purge support for index.xml and index.jar
We've had support for index-v1.json for 3-4 years. I think we can purge support for index.xml and index.jar entirely from the client. That means we can purge lots of hacks:
- remove support for unsigned index.xml, the index must always be a signed JAR
- remove support for parsing XML indexes entirely
- easily move the internal representation to one that matches metadata YAML and the index JSON
To keep supporting old Android versions, there would need to be a fallback option signed by SHA-1 signatures. Either index-v1.jar stays at SHA-1 forever, or if its moved to SHA-256, then index-v1.jar could be reverted to SHA-1 to maintain supporting old Android versions.