Paru has not been updated in months and is incompatible with the current
version of pacman / libalpm, which is v16.0.0. See upstream issue [1].
Replace paru with yay so the action works again.
Also updated CI test with latest Spotify as the old version is gone now.
[1] https://github.com/Morganamilo/paru/issues/1454
Without this, the only way to build PKGBUILDs with signatures is to pass
--skippgpcheck to makepkg.
Also switched to a package with PGP keys to verify.