Make package manifest independent of Git

[OskarEichler]

Replace git ls-files with a deterministic Ruby manifest. Source-archive and Git-less builds currently succeed with zero packaged files; the candidate preserves the current 70-path package from both a checkout and an archive. Verified with the full 502-example suite, package builds and path parity on Ruby 4.0 and Ruby 3.2.11, plus RuboCop and syntax checks.

[santiagorodriguez96]

Hey @OskarEichler! Thanks for the patch!

I'm curious about what prompted this: is there a build you're blocked on or is it preventative? Asking because the same pattern is in cose-ruby, tpm-key_attestation, android_key_attestation and openssl-signature_algorithm too, all in webauthn's dependency chain – I noticed that you also opened a similar PR in safety_net_attestation (cedarcode/safety_net_attestation#16) – so if there's a concrete need, I'd rather do the whole set at once.

My only concern is: unlike git ls-files, these globs would ship untracked files. Not an issue for releases since we added a release task a while back, but something to keep an eye on when building locally.