Support multiple timestamp authorities for jar signing

Similar to other signing services the jar signing service should also support specifying multiple timeserver urls to provide failover in case the one specified is not reachable. This happens from time to time and creates service disruption.

There is a PR for the maven-jarsigner-plugin that we could use as inspiration:

https://github.com/apache/maven-jarsigner-plugin/pull/19/files