This requires adjusting a number of test that reflect the ordering. The
changes in tests/rpmsigdig.at look straight forward and correct - just
changing the order in which the signatures and checksums are presented.

The changes in tests/rpmi.at seem to drop the relevant information. This
might be accidental as the code just returns the first issue found. But
"no signature" seems kinda weird result when before it complaint about a
specific signature. The next patch tries to fix that.

Resolves: rpm-software-management#3185

Don't rely on the fist issue found being the most meaningful. Always
return 1 to loop through all signatures / hashes. Use the first error of
the highest severity.

Using the severity in vd->type[] is a bit of a hack but OK as it is only
checked for == RPMRC_OK (aka 0) in verifyPackageFiles.

Related: rpm-software-management#3185