Teach git fast-import to check signatures

To be able to add new flags to git-filter-repo so it can better handle signed commits and tags as discussed in #510, we need to improve git fast-import first so that it can:

• check commit, and possibly tag, signatures,
• if they become invalid either:
  • error out,
  • drop the signature(s),
  • resign the commit (or possibly tag).

So far the following changes have been implemented in git fast-import as part of this issue:

• !414 (closed) added a new --signed-commits=<mode> option that allows to either drop commit signatures unconditionally, or import them unconditionally, or abort if there is one,
• !431 (closed) added a new --signed-tags=<mode> option that allows the same options for tag signatures,
• !447 added a new 'strip-if-invalid' mode to --signed-commits=<mode> to check commit signatures and drop them if they are invalid

Let's leave the rest for a new different issue (#619) so that we can close this one after !447 is merged.