Correct enforcing fingerprint

[tschmidtb51]

Currently, it is possible to add a OpenPGP key to a PMD without adding the fingerprint:

Quoting from https://docs.oasis-open.org/csaf/csaf/v2.0/provider_json_schema.json

    "public_openpgp_keys": {
      "title": "List of public OpenPGP keys",
      "description": "Contains a list of OpenPGP keys used to sign CSAF documents.",
      "type": "array",
      "items": {
        "title": "PGP keys",
        "description": "Contains all information about an OpenPGP key used to sign CSAF documents.",
        "type": "object",
        "required": [
          "url"
        ],
        "properties": {
          "fingerprint": {
            "title": "Fingerprint of the key",
            "description": "Contains the fingerprint of the OpenPGP key.",
            "type": "string",
            "minLength": 40,
            "pattern": "^[0-9a-fA-F]{40,}$"
          },
          "url": {
            "title": "URL of the key",
            "description": "Contains the URL where the key can be retrieved.",
            "$ref": "#/$defs/url_t"
          }
        }
      }
    }

The schema does not enforce the fingerprint, which is in contrast to Example 124 (see https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html#717-requirement-7-provider-metadatajson) which is labeled as Minimal but contains a fingerprint value.

It must be an oversight, that the fingerprint is not required per schema. We should correct that.