don't include .idsig files into the index

.idsig files contain an apksig v4 (https://source.android.com/security/apksigning/v4) new versions of apksigner make this signature by default and it ends up in /repo. Without this patch it would be included into the index as a file to be downloaded by users. F-Droid Client crashes when it encounters such an apk entry.

It's fine to have these signature files in the repo though, maybe fdroidclient can make use of them at some point in the future (they are intended to support streaming app installations).