upstream: Fix 'signature-urls' coalescing.

Previously, the resulting 'signature-urls' would contain N times the
same URL.

* guix/upstream.scm (coalesce-sources): Fix TWO in 'signature-urls'.
* tests/upstream.scm: New file.
* Makefile.am (SCM_TESTS): Add it.