Fixes to download + SBOM validation scripts

[sxa]

Post-GA fixes to the download + SBoM validation scripting introduced via #3484. Note that this does not address the other issues with this as per #3621 #3565

• Stop forcing VERBOSE to false
• Show start/end times for downloads because ... it's interesting to note
• Stop displaying the GPG output in the log because it's just noise
• Fix minimum number of artifacts in tarballs (AIX static libs has 38)
• Stop checking for FREEMARKER as we don't use it
• Freetype version is now appearing as "Unknown" since we started using bundled freetype - Raised at SBOM jdk-21+ FreeType value set to "Unknown" #3661
• Multiple other freetype versions corrected.
• OpenJDK Source Commit in the SBoM appears multiple times - this dedups before trying to use it in a grep operation (!)
• Adjust detection of git SHA in the remote repository

Note that jdk8u402-b02 does not pass the tests due to an issue with the Win32 MSI checksum which has a path prefix on the filename. This has been raised at #3662

Related (and not addressed by this PR):

• Improvement suggestions for the SBoM generation process #3565
• SBoM validation should check OS Architecture is valid #3621

[sxa]

When I started on this I thought it was going to be a simple fix but there ended up being quite a lot of changes and a couple of real bugs identified. This is now ready for review and merging after complying with the linter. I have verified it on all four release lines from January, and the only issue is with the sha checksum of jdk8/win32/MSI as linked in the description.

Noting that the compilers checked for in these scripts should be kept in sync with https://github.com/adoptium/temurin-build/blob/master/FAQ.md#what-are-the-prerequisites-for-a-system-used-for-builds

[sxa]

Adding Andrew as reviewer as he volunteered yesterday :-)