refactor(plugin): 简化插件签名验证机制

- 移除远程密钥撤销检查功能
- 移除远程公钥列表拉取和缓存机制
- 将官方公钥改为客户端内置固定值
- 简化 GetPublicKeyByID 接口实现
- 移除相关的安全配置初始化代码
- 将插件仓库URL配置改为可配置化设置

internal/client/tunnel/client.go

@@ -578,17 +578,6 @@ func (c *Client) verifyJSPluginSignature(pluginName, source, signature string) e
 		return fmt.Errorf("decode signature: %w", err)
 	}
 
-	// 检查插件是否被撤销
-	if revoked, reason := sign.IsPluginRevoked(pluginName, signed.Payload.Version); revoked {
-		return fmt.Errorf("plugin %s v%s has been revoked: %s",
-			pluginName, signed.Payload.Version, reason)
-	}
-
-	// 检查密钥是否已吊销
-	if sign.IsKeyRevoked(signed.Payload.KeyID) {
-		return fmt.Errorf("signing key %s has been revoked", signed.Payload.KeyID)
-	}
-
 	// 根据 KeyID 获取对应公钥
 	pubKey, err := sign.GetPublicKeyByID(signed.Payload.KeyID)
 	if err != nil {