report who accepted the connection in ListenAddressBindsOnlyThatAddress - #328

build-release.ps1 built the binaries from the working tree but archived the
local master ref, so the signed source zip need not match the signed binaries.

* Refuse a dirty tree, archive HEAD, and ship a signed .manifest recording the
  commit and the artifact set. No origin/master check: that needs the network
  and forbids cutting a release from a tag or a release branch.
* Both verifiers check the commit against the zip archive comment and the
  listed set against the files present. The hash and signature loops only see
  the files that are there, so an artifact deleted with its .sha512 and .asc
  passed before.
* Everything the release writes gets LF, asserted in the tests. Set-Content
  writes CRLF on Windows, where a trailing CR breaks sha512sum on macOS and
  makes every manifest name compare unequal. Includes the .sha512 fix from
  #328; #328 gets rebased onto this.
* sign-log4net-libraries.sh gains set -euo pipefail and shopt -s nullglob. An
  empty directory iterated the glob patterns and still exited 0.

audit da18b6f-f025

#328

build-release.ps1 built the binaries from the working tree but archived the
local master ref, so the signed source zip need not match the signed binaries.

* Refuse a dirty tree, archive HEAD, and ship a signed .manifest recording the
  commit and the artifact set. No origin/master check: that needs the network
  and forbids cutting a release from a tag or a release branch.
* Both verifiers check the commit against the zip archive comment and the
  listed set against the files present. The hash and signature loops only see
  the files that are there, so an artifact deleted with its .sha512 and .asc
  passed before.
* Everything the release writes gets LF, asserted in the tests. Set-Content
  writes CRLF on Windows, where a trailing CR breaks sha512sum on macOS and
  makes every manifest name compare unequal. Includes the .sha512 fix from
  #328; #328 gets rebased onto this.
* sign-log4net-libraries.sh gains set -euo pipefail and shopt -s nullglob. An
  empty directory iterated the glob patterns and still exited 0.

audit da18b6f-f025

#328

#328

#328

- A filtering proxy (ESET on Linux) accepts the connection and closes
  it, so a successful connect does not mean the appender is reachable
- The test now fails only on the greeting or the too-many-connections
  reply, which only a wrongly bound appender sends