Add "-9" as argument to "git archive".

Also simplify the argument list into a single <arg line="..."/> element.

The release files are signed but verifying the signatures cannot
catch certain types of attacks:

1. A malicious maintainer could make more than one variant of
   a package. One could be for general distribution. Another
   with malicious content could be targeted to specific users,
   for example, distributing the malicious version on a mirror
   controlled by the attacker.

2. If the signing key of an honest maintainer was compromised
   without being detected, a similar situation as described
   above could occur.

SHA256SUMS could be put on the project website but having it in
the Git repository makes it obvious that old lines aren't modified
when the file is updated.

It can happen when encoding a file larger than 65536 bytes. Decoders
catch the corruption because the integrity check doesn't match.

The encoder bug doesn't occur if one only adds

    options.setMode(LZMA2Options.MODE_UNCOMPRESSED);

to XZEncDemo.java because XZEncDemo uses 8192-byte input buffer
which perfectly divides 65536. If the buffer size is changed, then
XZEncDemo will trigger the bug.

Reported-by: Daniel Wilhelm
Fixes: daface1 ("Add LZMA2 encoder.")
Fixes: #21

If uncompBuf is empty and UncompressedLZMA2OutputStream.write is called
with len >= 64 KiB, then a full LZMA2 chunk can be copied directly from
the input buffer to the output stream. This can improve speed by a tiny
amount in specific use cases.

Suggested-by: Daniel Wilhelm <wilhelm@appwork.org>

bitRes is obviously at most 7 and thus (1 << bitRes) is at most 128,
so there is no risk of overflow. Coverity still doesn't like it because
the resulting int is widened to a long before the bitwise-and with instr.
Use (1L << bitRes) to avoid the widening and thus the warning.

Silences: Coverity CID 638721

There is no functional change because low.length == mid.length,
but it clearly was wrong still.

Fixes: Coverity SID 638698

No class in this package currently uses ResettableArrayCache so
mentioning it in a comment is odd.