Add an API to verify a commit signature explicitly

We have a bunch of APIs to do GPG verification of a commit,
but that doesn't generalize to signapi.  Further, they
require the caller to check the signature status explicitly
which seems like a trap.

This much higher level API works with both GPG and signapi.
The intention is to use this in things that are doing "external
pulls" like the ostree-ext tar import support.  There we will
get the commitmeta from the tarball and we want to verify it
at the same time we import the commit.

apidoc/ostree-sections.txt

@@ -474,6 +474,7 @@ ostree_repo_append_gpg_signature
 ostree_repo_add_gpg_signature_summary
 ostree_repo_gpg_sign_data
 ostree_repo_gpg_verify_data
+ostree_repo_signature_verify_commit_data
 ostree_repo_verify_commit
 ostree_repo_verify_commit_ext
 ostree_repo_verify_commit_for_remote