pull: Verify commits with gpg signatures from detached metadata

This uses gpgv for verification against DATADIR/ostree/pubring.gpg by
default.  The keyring can be overridden by specifying OSTREE_GPG_HOME.

Add a unit test for commit signing with gpg key and verifying on pull;
to implement this we ship a test GPG key generated with no password
for Ostree Tester <test@test.com>.

Change all of the existing tests to disable GPG verification.

src/libostree/ostree-repo.h

@@ -470,6 +470,13 @@ gboolean ostree_repo_sign_commit (OstreeRepo     *self,
                                   const gchar    *homedir,
                                   GCancellable   *cancellable,
                                   GError        **error);
+
+gboolean ostree_repo_verify_commit (OstreeRepo   *self,
+                                    const gchar  *commit_checksum,
+                                    GFile        *keyringdir,
+                                    GFile        *extra_keyring,
+                                    GCancellable *cancellable,
+                                    GError      **error);
 #endif
 
 G_END_DECLS