This adds a new -s flag to 'got tag' that specifies the signer identity (for example, a key file) of the tagger. The tag object will include a signature that validates each of the tag object headers and the tag message. Verifying these signed tags requires maintaining an allowed signers file which maps signer identities (i.e. the email address of the tagger) to SSH public keys. See ssh-keygen(1) for more details of the allowed signers file. After creating this file and providing the path to it in got.conf(5) using the allowed_signers option, tags may be verified using with 'got tag -V tag_name'. The return code will be non-zero if a signature fails to verify. ok stsp@

Saves us from doing a malloc/free call for every item on the list. ok op@

Instead of internally opening and closing the same commit object over and over again, require callers to pass an open commit object in. Avoids an inherent dependency on the commit object cache for reasonable performance. ok op@

Need for filtering by path sugggested by kn@ ok naddy@

The singly-linked tail queue macros were added to OpenBSD 6.9 and are more widely available on other systems. ok stsp

This will be required by a future 'gotadmin pack' command.

This will be required by a future 'gotadmin pack' command.