Handle tools.jar (and other 'provided' jars)

[Kortanul]

almost 100% of the time, tools.jar is provided by the local JVM, and the version Maven uses for it is the minimum version required but might not be the installed version. in other words, version in POM might indicate that 1.5.0 is required (i.e. com.sun:tools:jar:1.5.0), but because JDK 1.8 is installed, it's using the tools from 1.8 (e.g. com.sun:tools:jar:1.8.0).

since the artifact ships without a signature in the JDK, it fails validation. if you sign it and upload the armor file to a trusted local repo, then the issue is that the signature may not match because the version of tools being used locally differs from the signed copy even though the group, artifact, and version seem to match.