Instead of relying on individual license attribution per file, configure
license attribution in the REUSE.toml file.
Moreover, use the generic "Signstar Contributors" as attribution and
in a comment point out that the license attribution is not tracked
individually, but that interested parties can get to this information
with the help of git.
Set SPDX package supplier to "Arch Linux" as the meaning of the field is
better reflected by an organization than an individual:
https://spdx.github.io/spdx-spec/v2.3/package-information/#75-package-supplier-field



Signed-off-by: David Runge <dvzrv@archlinux.org>