Allow configuration of GPG key ID whitelist

[jarrodldavis]

For repository owners that want stricter control of GPG verification keys, allow them to configure a whitelist of approved GPG keys. Also consider ways of streamlining the whitelisting process such as email-based approval.

Resources:

• https://developer.github.com/v3/users/gpg_keys/#list-gpg-keys-for-a-user
• https://developer.github.com/v3/repos/commits/#get-a-single-commit
• https://developer.github.com/v3/git/commits/#commit-signature-verification