JAR Verification should allow adding entries, as does Oracle

[KonstantinShemyak]

Oracle's Jar file specification describes JAR verification:

A successful JAR file verification occurs if the signature(s) are valid, and none of the files that were in the JAR file when the signatures were generated have been changed since then.

Python-javatools require more: we check that all MANIFEST.MF is correctly hashed (Oracle would allow new entries there), and that all JAR entries are correctly hashed in the manifest (Oracle would allow new entries).