pull: Verify commits with gpg signatures from detached metadata

This uses gpgv for verification against DATADIR/ostree/pubring.gpg by
default.  The keyring can be overridden by specifying OSTREE_GPG_HOME.

Add a unit test for commit signing with gpg key and verifying on pull;
to implement this we ship a test GPG key generated with no password
for Ostree Tester <test@test.com>.

Change all of the existing tests to disable GPG verification.

src/libostree/ostree-sysroot.c

@@ -232,7 +232,8 @@ ostree_sysroot_ensure_initialized (OstreeSysroot  *self,
   if (!g_file_query_exists (dir, NULL))
     {
       gs_unref_object OstreeRepo *repo = ostree_repo_new (repo_dir);
-      if (!ostree_repo_create (repo, OSTREE_REPO_MODE_BARE, cancellable, error))
+      if (!ostree_repo_create (repo, OSTREE_REPO_MODE_BARE,
+                               cancellable, error))
         goto out;
     }