Fix apksigner failing on Java 17+ with PKCS#11

Fixes #1313

Questions

I am not sure where to best integrate the "new" CLI flag that is needed. The problem is that it must come between apksigner and sign. So we cannot simply add it to get_apksigner_smartcardoptions(),

The way I did it now makes it work for me and my Nitrokey HSM on Debian 13. But it also "pollutes" the commands for everyone else who does not use a PKCS#11 token and thus does not need this argument. Therefore, I am marking this MR as draft, and I am open for suggestions for where to best hook this new argument in 😬

Testing

I tested this fix with Debian 13 and a Nitrokey HSM.